Vulnerability · Published Jun 15, 2026 · Assigned by VulnCheck

CVE-2026-49954Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory

High 7.2

In plain English

A high-severity security flaw in Discuz! X5.0 from Discuz!. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.5%top 55.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigger an exception during plugin installation to bypass sanitization routines, causing malicious paths to be stored unsanitized and subsequently passed to include(), which combined with file upload functionality escalates to arbitrary code execution in the context of the web server user.

Affected products (as reported)

Vendor	Product	Versions
Discuz!	Discuz! X5.0	20260320 – through 20260610

Weakness: CWE-98 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://karmainsecurity.com/KIS-2026-11 technical-description
https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce exploit
https://www.vulncheck.com/advisories/discuz-x5-0-local-file-inclusion-via-enable-disable-php-plugin-directory third-party-advisory
http://seclists.org/fulldisclosure/2026/Jun/5