XenForo Path Disclosure Vulnerability via open_basedir Exceptions

A path disclosure vulnerability has been identified in XenForo versions prior to 2.3.7. This issue arises from exception messages that reveal filesystem paths, triggered by open_basedir restrictions. An attacker could exploit this vulnerability to gain insights into the server's directory structure.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of filesystem paths, allowing attackers to infer the server's directory structure.

Remediation

Users are advised to upgrade to XenForo version 2.3.7 or apply the available patch. Instructions for upgrading and applying the patch can be found in the XenForo 2.3.7 release announcement.