phpBB includes a flaw that permits authenticated users to upload crafted zip files containing serialized PHP objects that are deserialized by the imagick processing component. The deserialization triggers arbitrary code execution, giving the attacker the ability to run commands on the web server. The weakness is rooted in improper handling of file paths and untrusted input, classed under the Path Traversal category. The potential impact is full compromise of the PHP process and the underlying system, affecting confidentiality, integrity, and availability of the affected forum installation.

The vulnerability affects the phpBB forum software, specifically versions 3.2.3 and earlier. CPE data indicates that all releases of phpBB are susceptible, with the general exception of any fixed revisions released after the advisory.

The CVSS base score is 8.7, indicating a high severity vulnerability. The EPSS score is under 1%, suggesting a low current exploit probability, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with access to the attachment upload feature, and it depends on the application allowing the use of the phar:// stream wrapper and processing zip archives containing malicious objects. Once the conditions are met, the attacker can achieve remote code execution.