CVE-2026-79362

Deferred Deferred - Pending Action

Remote Code Execution in WoltLab Suite Core via Cache Poisoning

Publication date: 2026-09-11

Last updated on: 2026-09-21

Assigner: MITRE

Description

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject arbitrary PHP Code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-21

Generated

2026-10-02

AI Q&A

2026-09-11

EPSS Evaluated

2026-09-29

NVD

CVE-2026-79362

EUVD

EUVD-2026-76188

Affected Vendors & Products

Vendor	Product	Version / Range
woltlab	wcf	From 6.1.0 (inc) to 6.1.23 (exc)
woltlab	wcf	From 6.2.0 (inc) to 6.2.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-79362 is an authenticated Remote Code Execution (RCE) vulnerability in WoltLab Suite Core affecting versions 6.1.0 to 6.1.22 and 6.2.0 to 6.2.5. An authenticated low-privileged user can inject PHP code into cache files by terminating the nowdoc prematurely. This allows arbitrary code execution on the server.

Detection Guidance

Check WoltLab Suite versions for affected releases (6.1.0 to <6.1.23 and 6.2.0 to <6.2.6). Inspect cache files for unusual PHP code or unexpected .v2.php files. Use server logs to identify unauthorized cache file modifications or suspicious user activity.

Impact Analysis

This vulnerability allows attackers with low privileges to execute arbitrary code on the server. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. All versions before 6.1.23 and 6.2.6 are affected.

Compliance Impact

This vulnerability allows authenticated low-privileged users to inject PHP code into cache files, enabling remote code execution. Such unauthorized code execution could lead to unauthorized data access, modification, or exfiltration, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Update WoltLab Suite to versions 6.1.23 or 6.2.6 or later immediately. Flush all cache files to remove potentially compromised versions. Ensure the update is applied via the Administration Control Panel by checking for updates in the package list.

Hi! I’m here to help you understand CVE-2026-79362. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70