A flaw in My-Little-Forum’s image upload validation permits the PHP archive protocol to reach the BBCode [img] tag processor. By uploading a malicious Phar Polyglot file that masquerades as a JPEG, an attacker can trigger the Smarty templating engine’s deserialization routine and exploit a known POP chain to delete files owned by the application. This results in the loss of critical data or configuration files and can cripple forum availability while potentially facilitating further compromise. The weakness is identified as both unsafe deserialization (CWE-502) and hazardous file deletion (CWE-434).

Versions of My-Little-Forum released before 20260208.1 are affected. All clients running the application’s image upload and BBCode parsing components prior to this patch are vulnerable.

The vulnerability scores a CVSS of 8.7, indicating high severity. The EPSS score is less than 1%, suggesting that exploitation attacks are rare or difficult to execute. The issue is not currently listed in the CISA Known Exploited Vulnerability catalog. The likely attack vector is through the publicly accessible image upload endpoint; an attacker can craft an upload with a phar:// URL embedded in an [img] tag, causing the server to delete arbitrary files the application can reach. Successful exploitation would undermine availability and could be leveraged for additional attacks on the system.