Remote Code Execution in WoltLab Suite Core via Cache Poisoning

Executive Summary

CVE-2026-79362 is an authenticated Remote Code Execution (RCE) vulnerability in WoltLab Suite Core affecting versions 6.1.0 to 6.1.22 and 6.2.0 to 6.2.5. An authenticated low-privileged user can inject PHP code into cache files by terminating the nowdoc prematurely. This allows arbitrary code execution on the server.

Useful 0 Not Useful 0

Detection Guidance

Check WoltLab Suite versions for affected releases (6.1.0 to <6.1.23 and 6.2.0 to <6.2.6). Inspect cache files for unusual PHP code or unexpected .v2.php files. Use server logs to identify unauthorized cache file modifications or suspicious user activity.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with low privileges to execute arbitrary code on the server. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. All versions before 6.1.23 and 6.2.6 are affected.

Useful 0 Not Useful 0

Mitigation Strategies

Update WoltLab Suite to versions 6.1.23 or 6.2.6 or later immediately. Flush all cache files to remove potentially compromised versions. Ensure the update is applied via the Administration Control Panel by checking for updates in the package list.

Useful 0 Not Useful 0