by Kastro
Paper/Archive/CVE-2025-34060

CVE-2025-34060

Monero Project Forum — Monero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery

EPSS 0.8%public exploitCVSS 10.0
critical.is priorityof 100
51
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 56.5.565 × 2011.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.

Affected

ProductAffectedFixed inSource
Forumall versions–CNA

Scores by source

VulnCheck (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupswap.gs/posts/monero-forumswriteupvulncheck.com/advisories/monero-forum-rce