CVE-2026-73315CWE-918ssrf

CVE-2026-73315

High · published September 8, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
28.2
In the wild
Unconfirmed
What it is

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
7.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00357 · 28.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-08T18:17Z
Affected products (1)
ProductVersionsFixed in
xenforo/xenforo< 2.3.132.3.13
References (5)
https://bombobombone.github.io/posts/cve-2026-73315/ · [email protected]https://github.com/BomboBombone/CVE-2026-73315 · [email protected]https://www.vulncheck.com/advisories/xenforo-ssrf-via-paypal-rest-webhook-handler · [email protected]https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/ · [email protected]https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/ · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 13:18Z
    XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
    cvelistv5