CVE-2026-25923 is a critical flaw (CVSS 9.1) in my little forum, the PHP and MySQL forum. A disguised Phar upload plus the BBCode image tag can trigger deserialization and arbitrary file deletion. Upgrade to 20260208.1 and keep image uploads off. The record does not list it in CISA's KEV catalog, and the sources we read do not report exploitation.
What's affected
- my little forum before 20260208.1
- Fixed in 20260208.1
The project advisory describes the conditions: PHP below 8.0, image upload enabled (it is off by default), BBCode enabled (the default), and an account that can post, or anonymous upload enabled. The advisory also says Phar metadata deserialization on file access was removed in PHP 8.0. The advisory page lists versions up to 20251129.1 as affected and names no patch, while the record and the project release point to 20260208.1 as the fix, so confirm with the release notes.
How to check if you're exposed
Check the forum version in your installation against 20260208.1. Then look at three settings in the forum administration: whether image upload is enabled, whether BBCode is enabled, and who may upload. Finally, check your PHP version on the server. PHP 8.0 or later removes the automatic behavior the advisory relies on.
If image upload is off and you do not need it, you are not on the path described.
What to do now
- Upgrade my little forum to 20260208.1 or later.
- Turn off image upload if you do not need it. The advisory lists keeping it off as a mitigation.
- Move the server to PHP 8.0 or later, which removes the Phar behavior the advisory describes.
- Restrict who can upload, and review the uploads folder for files that are not images.
- Check that the web server account can only delete files it needs to.
Why it matters
The classes are CWE-434, unrestricted upload of a dangerous file type, and CWE-502, deserialization of untrusted data. The advisory describes a chain. URL validation did not block the phar stream wrapper, a Phar archive disguised as a JPEG was accepted, and processing of the BBCode image tag caused PHP to read the archive, which deserializes its metadata. A library already present in the application supplied the gadget that ends in arbitrary file deletion.
No single step is the whole bug. A file check, a URL check and a library each looked fine alone. Chains like this are why upload features deserve a hard look: validate content, store uploads outside the code path, and never let user supplied paths reach functions that touch the file system.
The score is 9.1 with high impact on integrity and availability and none on confidentiality.
Quick check
Is image upload on by default?
The advisory says no. The setting defaults to disabled.
Does PHP 8 solve this?
The advisory says automatic Phar metadata deserialization was removed in PHP 8.0, which breaks the chain it describes. Upgrade the forum anyway.
Sources
- https://github.com/My-Little-Forum/mylittleforum/releases/tag/20260208.1
- https://github.com/My-Little-Forum/mylittleforum/security/advisories/GHSA-wr9p-3c3g-78fw
Last reviewed: 19 October 2026.
