UBB.threads suffers from a path‑traversal flaw that lets an authenticated user with permission to edit templates read and write any file that the application process can access. Exploiting the vulnerability can grant the attacker the ability to execute arbitrary code on the host, effectively compromising the entire server. According to the CVE description, the weakness aligns with CWE‑22, which represents an insecure handling of file paths.

The vulnerability has been confirmed in UBB Systems’ UBB.threads version 7.7.5. While other releases may be impacted, no further version information is available. Administrators of UBB.threads installations should verify the exact version they are running and determine whether it is 7.7.5 or an earlier release that could be affected.

The CVSS score of 8.6 indicates a high severity, with the likelihood of exploitation amplified by the need for privileged access to edit templates. The EPSS score is not available, so the current exploitation probability cannot be quantified; however, the flaw was publicly announced and documented on CERT and the vendor’s website, making it highly visible to attackers. Because the vulnerability is not listed in CISA’s KEV catalog, it has not yet been confirmed as exploited in the wild, but the high CVSS and the nature of the flaw warrant immediate attention.