CVE-2026-25923

CVE-2026-25923 affects My Little Forum (PHP/MySQL). Before version 20260208.1, URL validation fails to filter the phar:// protocol, enabling an attacker to upload a malicious Phar Polyglot file (disguised as JPEG) via the image upload feature. The exploit triggers Phar deserialization during BBCo...