UBB.threads forum flaws enable RCE, SQLi
Six unpatched vulnerabilities in UBB.threads forum software allow XSS, CSRF, blind SQL injection, path traversal RCE, and DoS attacks.
Sourcecert.pl — open the original
What to check
- Applies to
- The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of six vulnerabilities affecting UBB.threads forum software, reported by researchers Kamil Szczurowski and Michał Wnękowicz from Securitum. The flaws range from stored and reflected XSS and CSRF to a blind SQL injection accessible via the Members Control Panel, and a path traversal vulnerability in the template editor that can be leveraged to achieve remote code execution by reading and writing arbitrary files on the server. A separate denial-of-service issue allows an authenticated attacker to exhaust database resources by flooding profile view requests, taking the application offline for other users.
All six issues were confirmed against UBB.threads version 7.7.5, though other versions may be affected. CERT Polska notes that attempts to contact the vendor were unsuccessful, meaning no official patch or vendor advisory currently exists for any of these vulnerabilities. This leaves administrators of UBB.threads-based forums without a clear remediation path other than restricting access to sensitive functionality (Control Panel, template editing) and monitoring for anomalous input in posts, profile fields, and requests.
While there is no evidence of active exploitation in the wild, the combination of an unresponsive vendor and a path traversal flaw capable of remote code execution represents a meaningful risk for any internet-facing UBB.threads deployment. The vulnerabilities span multiple attack surfaces (client-side scripting, database access, file system, and availability), making comprehensive mitigation difficult without vendor cooperation.
Mentioned in this report
Detection guidance
UBB.threads Template Editor Path Traversal Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to the UBB.threads template editor endpoint containing directory traversal sequences, indicative of attempts to read/write arbitrary files leading to RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: UBB.threads Template Editor Path Traversal Attempt
description: Detects requests to template/style editing functionality in UBB.threads
that contain path traversal sequences or attempts to reference files outside the
template directory, consistent with the disclosed path traversal to RCE vulnerability.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- template
- style
- editor
selection_traversal:
cs-uri-query|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- ..%5c
condition: selection_endpoint and selection_traversal
falsepositives:
- Legitimate template file browsing that references relative paths within an allowed
template directory (rare, should not include parent-directory sequences)
- Vulnerability scanners probing the application
level: high
id: 79d0563a-6603-5aa4-9a43-2c75299a7e08
status: experimental
author: Vorant
Blind SQL Injection Attempt Against UBB.threads Members Control Panel
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to profile/MCP endpoints containing time-based blind SQL injection payloads (SLEEP/BENCHMARK/WAITFOR) as described in the disclosed vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Blind SQL Injection Attempt Against UBB.threads Members Control Panel
description: Detects requests to profile or Members Control Panel endpoints that contain
classic time-based/boolean blind SQL injection payloads. Generalises on the injection
primitives rather than a specific parameter name, since the report describes a blind
SQLi reachable via MCP.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- mcp
- profile
- members
selection_sqli:
cs-uri-query|contains:
- SLEEP(
- BENCHMARK(
- WAITFOR DELAY
- ' OR 1=1'
- UNION SELECT
- ''' AND ''1''=''1'
condition: selection_endpoint and selection_sqli
falsepositives:
- Security scanning tools or authorized penetration tests probing the same endpoints
- Rare legitimate query strings that happen to contain SQL keywords (e.g. search fields
echoing SQL-like text)
level: high
id: 59c2a446-8c6e-5fd0-b47a-980222f429f1
status: experimental
author: Vorant
Web Server Process Spawning Shell After Suspected File-Write Exploitation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server process (Apache/Nginx/PHP-FPM/IIS worker) spawning a command interpreter, a common post-exploitation indicator following successful arbitrary file write/RCE such as the UBB.threads template editor path traversal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell After Suspected File-Write Exploitation
description: Detects web server worker processes spawning shells or interpreters shortly
after handling requests, consistent with successful exploitation of a path-traversal/arbitrary-file-write
vulnerability (e.g. the UBB.threads template editor flaw) that drops and executes
a web shell.
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php-cgi
Image|endswith:
- /sh
- /bash
- /dash
- /perl
- /python
- /python3
filter_common_cgi:
CommandLine|contains:
- logrotate
- healthcheck
condition: selection and not filter_common_cgi
falsepositives:
- Legitimate CGI scripts or server-side scripting frameworks that intentionally shell
out for maintenance tasks
- Custom application deployments that invoke interpreters directly from the web server
process
level: high
id: 7b5b7a55-4abf-5db1-84a5-abac81a852ff
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-54219
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs