Discuz! X5.0 vulnerabilities

2 known vulnerabilities in Discuz! X5.0 from Discuz!. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Discuz! X5.0: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2026-49954Jun 15, 2026Discuz!

  Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the dir

• 9.1 Critical severity

  Discuz! X5.0: Reusing a Nonce, Key Pair in Encryption

  CVE-2026-49952Jun 15, 2026Discuz!EPSS 4.72%

  Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key betwe