CVE-2024-58295

HighCVSS 8.6

Published: 11/12/2025(UTC)Updated: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

44th percentile - higher than 44% of all known CVEs

Summary

ElkArte Forum 1.1.9 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the theme installation process. Attackers can upload a ZIP archive with a PHP file containing system commands, which can then be executed by accessing the uploaded file in the theme directory.

Risk Assessment

An authenticated administrator can execute arbitrary code on the server, leading to full system compromise and breach of confidentiality, integrity, and availability of data.

Recommendation

Update ElkArte Forum to a version later than 1.1.9, restrict administrative privileges, and validate uploaded theme archives for malicious PHP files.

Other vulnerabilities in ElkArte Forum

CVE-2026-72553Medium
A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_locate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An attacker can execute code in an administrator session, enabling session hijacking or privilege escalation.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS