CVE-2026-49954: Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory

Synopsis

Local file inclusion (LFI) vulnerability in Discuz! X5.0 (releases 20260320 through 20260610) lets an authenticated administrator execute arbitrary code on the server. The attack is reachable over the network but requires a valid admin account; the attacker imports a crafted plugin configuration containing path traversal sequences, triggers an exception to bypass sanitization, and causes a malicious path to be stored unsanitized and passed to PHP's include() function. Combined with file upload functionality, this escalates to arbitrary code execution running as the web server user. HarborGuard is tracking this advisory for patch availability, as no fix version has been published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the Discuz! web service via HTTP/HTTPS.

• AuthenticationRequired

  A valid administrator account is required; any lower-privilege account is insufficient because the plugin import functionality is restricted to admin users.

• Victim interactionNot required

  No victim action is needed; the attacker initiates the full exploit chain autonomously after authenticating.

• Attack complexityDetail

  Exploitation is reliable and condition-free once admin credentials are obtained; the exception-triggering bypass is deterministic and does not depend on race conditions or environmental factors.

Blast Radius

• Reads arbitrary files from the server filesystem accessible to the web server user, including configuration files containing database credentials and secret keys.
• Executes arbitrary PHP code in the context of the web server user, enabling full control of the application runtime.
• Modifies application data, session stores, or persisted database rows through the code execution primitive.
• Crashes or destabilizes the web server process if the attacker chooses to disrupt availability.