Vulnerability · Published Feb 9, 2026 · Assigned by GitHub_M

CVE-2026-25923Phar Deserialization leading to Arbitrary File Deletion in my little forum

High 8.7

In plain English

A high-severity unrestricted file upload in mylittleforum from My-Little-Forum. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 57.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to 20260208.1, the application fails to filter the phar:// protocol in URL validation, allowing attackers to upload a malicious Phar Polyglot file (disguised as JPEG) via the image upload feature, trigger Phar deserialization through BBCode [img] tag processing, and exploit Smarty 4.1.0 POP chain to achieve arbitrary file deletion. This vulnerability is fixed in 20260208.1.

Affected products (as reported)

Vendor	Product	Versions
My-Little-Forum	mylittleforum	< 20260208.1

Weakness: CWE-434, CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/My-Little-Forum/mylittleforum/security/advisories/GHSA-wr9p-3c3g-78fw x_refsource_CONFIRM
https://github.com/My-Little-Forum/mylittleforum/releases/tag/20260208.1 x_refsource_MISC