# UBB.threads forum flaws enable RCE, SQLi

Published: 2026-06-18 · Severity: medium
Canonical: https://vorant.io/reports/eff8901f-15c4-5a65-a561-ee139468d2f7/ubb-threads-forum-flaws-enable-rce-sqli

> Six unpatched vulnerabilities in UBB.threads forum software allow XSS, CSRF, blind SQL injection, path traversal RCE, and DoS attacks.

CERT Polska coordinated disclosure of six vulnerabilities affecting UBB.threads forum software, reported by researchers Kamil Szczurowski and Michał Wnękowicz from Securitum. The flaws range from stored and reflected XSS and CSRF to a blind SQL injection accessible via the Members Control Panel, and a path traversal vulnerability in the template editor that can be leveraged to achieve remote code execution by reading and writing arbitrary files on the server. A separate denial-of-service issue allows an authenticated attacker to exhaust database resources by flooding profile view requests, taking the application offline for other users.

All six issues were confirmed against UBB.threads version 7.7.5, though other versions may be affected. CERT Polska notes that attempts to contact the vendor were unsuccessful, meaning no official patch or vendor advisory currently exists for any of these vulnerabilities. This leaves administrators of UBB.threads-based forums without a clear remediation path other than restricting access to sensitive functionality (Control Panel, template editing) and monitoring for anomalous input in posts, profile fields, and requests.

While there is no evidence of active exploitation in the wild, the combination of an unresponsive vendor and a path traversal flaw capable of remote code execution represents a meaningful risk for any internet-facing UBB.threads deployment. The vulnerabilities span multiple attack surfaces (client-side scripting, database access, file system, and availability), making comprehensive mitigation difficult without vendor cooperation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-54219, CVE-2026-54220, CVE-2026-54221, CVE-2026-54222, CVE-2026-54223, CVE-2026-54224

## Detection guidance (public sample)

### UBB.threads Template Editor Path Traversal Attempt

ATT&CK: T1190

Detects HTTP requests to the UBB.threads template editor endpoint containing directory traversal sequences, indicative of attempts to read/write arbitrary files leading to RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: UBB.threads Template Editor Path Traversal Attempt
description: Detects requests to template/style editing functionality in UBB.threads
  that contain path traversal sequences or attempts to reference files outside the
  template directory, consistent with the disclosed path traversal to RCE vulnerability.
tags:
- attack.initial_access
- attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - template
    - style
    - editor
  selection_traversal:
    cs-uri-query|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%2f
    - ..%5c
  condition: selection_endpoint and selection_traversal
falsepositives:
- Legitimate template file browsing that references relative paths within an allowed
  template directory (rare, should not include parent-directory sequences)
- Vulnerability scanners probing the application
level: high
id: 79d0563a-6603-5aa4-9a43-2c75299a7e08
status: experimental
author: Vorant
```

### Blind SQL Injection Attempt Against UBB.threads Members Control Panel

ATT&CK: T1190

Detects HTTP requests to profile/MCP endpoints containing time-based blind SQL injection payloads (SLEEP/BENCHMARK/WAITFOR) as described in the disclosed vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Blind SQL Injection Attempt Against UBB.threads Members Control Panel
description: Detects requests to profile or Members Control Panel endpoints that contain
  classic time-based/boolean blind SQL injection payloads. Generalises on the injection
  primitives rather than a specific parameter name, since the report describes a blind
  SQLi reachable via MCP.
tags:
- attack.initial_access
- attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - mcp
    - profile
    - members
  selection_sqli:
    cs-uri-query|contains:
    - SLEEP(
    - BENCHMARK(
    - WAITFOR DELAY
    - ' OR 1=1'
    - UNION SELECT
    - ''' AND ''1''=''1'
  condition: selection_endpoint and selection_sqli
falsepositives:
- Security scanning tools or authorized penetration tests probing the same endpoints
- Rare legitimate query strings that happen to contain SQL keywords (e.g. search fields
  echoing SQL-like text)
level: high
id: 59c2a446-8c6e-5fd0-b47a-980222f429f1
status: experimental
author: Vorant
```

### Web Server Process Spawning Shell After Suspected File-Write Exploitation

ATT&CK: T1190

Detects a web server process (Apache/Nginx/PHP-FPM/IIS worker) spawning a command interpreter, a common post-exploitation indicator following successful arbitrary file write/RCE such as the UBB.threads template editor path traversal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Shell After Suspected File-Write Exploitation
description: Detects web server worker processes spawning shells or interpreters shortly
  after handling requests, consistent with successful exploitation of a path-traversal/arbitrary-file-write
  vulnerability (e.g. the UBB.threads template editor flaw) that drops and executes
  a web shell.
tags:
- attack.execution
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /php-fpm
    - /php-cgi
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /perl
    - /python
    - /python3
  filter_common_cgi:
    CommandLine|contains:
    - logrotate
    - healthcheck
  condition: selection and not filter_common_cgi
falsepositives:
- Legitimate CGI scripts or server-side scripting frameworks that intentionally shell
  out for maintenance tasks
- Custom application deployments that invoke interpreters directly from the web server
  process
level: high
id: 7b5b7a55-4abf-5db1-84a5-abac81a852ff
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-54219

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/eff8901f-15c4-5a65-a561-ee139468d2f7/ubb-threads-forum-flaws-enable-rce-sqli.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup