Vulnerability · Published Jun 18, 2026 · Assigned by CERT-PL
CVE-2026-54223Remote Code Execution via arbitrary file read and write in UBB.threads
High 8.6
In plain English
A high-severity path traversal in UBB.threads from UBB Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Official description
UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any file on the application’s server that application has privileges to, what results in Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| UBB Systems | UBB.threads | 0 – through 7.7.5 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
References
- https://www.ubbcentral.com/ product
- https://cert.pl/en/posts/2026/06/CVE-2026-54219 third-party-advisory