CVE-2026-25923: my little forum: Phar deserialization leading to arbitrary file deletion
my little forum, a PHP and MySQL internet forum, does not filter the phar:// protocol during URL validation, which can lead to Phar deserialization and arbitrary file deletion. The record states the issue is fixed in 20260208.1, and NVD rates it critical with a CVSS base score of 9.1. No confirmed exploitation appears in the sources consulted, although SSVC lists exploitation status as proof of concept.
Overview
my little forum is a PHP and MySQL based internet forum. The record describes a flaw in which the phar:// protocol is not filtered during URL validation. This is classified as unrestricted upload of a file with a dangerous type (CWE-434) and involves Phar deserialization.
Impact
- The record states the flaw can lead to arbitrary file deletion.
- Inference: deleting arbitrary files on a web server can cause service outages, loss of forum data and integrity problems.
- NVD scores the issue at 9.1 (critical). The vector emphasizes high integrity and availability impact with no confidentiality impact.
Affected products and versions
- Product: Mylittleforum My Little Forum.
- Affected: versions before 20260208.1.
- Fixed in: 20260208.1, per the record and the vendor release.
Exploitation status
- CISA KEV does not list this CVE, so no active exploitation is confirmed by that source.
- No confirmed exploitation appears in the sources consulted.
- SSVC lists exploitation as proof of concept and automatable as yes, which indicates that public proof-of-concept material may exist. The vendor advisory is tagged with exploit-related references, but this does not confirm in-the-wild use.
Remediation and mitigation
- Upgrade to version 20260208.1 or later, as stated in the vendor release notes.
- Review the vendor advisory for the mitigation guidance it provides.
- Inference: restrict upload handling to validated image content and reject files that are not genuine images, without relying on file extensions alone.
- Inference: review whether the forum uses Smarty and keep it updated as part of the same maintenance cycle.
Detection guidance
- Review upload directories for files with image-like names that contain unexpected executable or archive structures.
- Monitor for unexpected deletions of application or user files.
- Review web server and application logs for requests that reference phar:// strings in parameters or BBCode content.
Limitations of the available information
- The record does not state whether older branches are affected beyond the endpoint given.
- The record does not describe the full set of conditions needed for exploitation in a default configuration.
- Whether Smarty is bundled with or required by the application is not stated in the record.
- The exact CVSS vector of the GitHub score is not reproduced here; only the score is reported.
Frequently asked questions
What is CVE-2026-25923?
It is a critical flaw in my little forum in which the phar:// protocol is not filtered during URL validation, which can lead to Phar deserialization and arbitrary file deletion.
Which version fixes the issue?
The record states that the issue is fixed in version 20260208.1, and that versions before it are affected.
Is this vulnerability being actively exploited?
CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. SSVC lists exploitation as proof of concept.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.