Vulnerability · Published Jul 1, 2025 · Assigned by VulnCheck

CVE-2025-34060Monero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery

Critical 10.0

In plain English

A critical-severity unsafe deserialization in Forum from Monero Project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 4.0)10.0Critical

Exploit odds (30 days)0.8%top 43.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Monero Project	Forum	0

Weakness: CWE-502, CWE-829, CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://swap.gs/posts/monero-forums/ technical-description
https://vulncheck.com/advisories/monero-forum-rce third-party-advisory