CVE-2023-5917 phpBB Smiley Pack acp_icons.php main cross site scripting
Remote attackers can inject malicious scripts via the Smiley Pack Handler in phpBB, potentially leading to session hijacking or code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-5917?
CVE-2023-5917 is a low-severity cross-site scripting vulnerability in phpBB, published on 2 Nov 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.
Weakness: CWE-79
Which versions are affected by CVE-2023-5917?
3 open source packages ship an affected version, including phpbb/phpbb and phpbb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpbb/phpbb Packagist | All versions | 3.3.11 |
phpbb/phpbb Packagist | All versions | 3.3.11 |
phpbb Bitnami | All versions | 3.3.11 |
Products include Phpbb Phpbb.
How do I fix CVE-2023-5917?
Upgrade phpbb/phpbb to 3.3.11 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-5917 being exploited?
There is no known exploitation of CVE-2023-5917 in the wild and no public exploit code.
Other vulnerabilities in phpBB
- CVE-2008-3224 Other in n/a
- CVE-2008-1766 Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bu
- CVE-2025-70810 Cross-site request forgery in n/a
- CVE-2001-1471 Code injection in n/a
- CVE-2026-29199 phpBB has Password Reset Link Poisoning via Host Header injection
Sources
Also known as BIT-phpbb-2023-5917, GHSA-gmx8-8rff-qv6q.