CVE-2007-2236: footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via...

Security readout for executives and security teams

This CVE affects very old PunBB forum software. The reported flaw lets a remote attacker cause PunBB to include local files from a user include path, with public reports describing possible PHP code execution through uploaded avatar content. There is no KEV listing or source-provided evidence of current active exploitation. Exposure is most likely on internet-facing PunBB 1.2.14 or earlier deployments, especially legacy forums with user uploads or pun_include functionality enabled. The normalized affected-product data is incomplete, so asset discovery should key on PunBB version evidence rather than CPE matches alone. Prioritize remediation if any PunBB 1.2.14 or earlier instance is reachable. The business risk is full forum compromise on obsolete software, but urgency depends on whether such legacy systems still exist in the environment. Mitigation focus: Inventory public and internal PunBB installations and confirm exact versions.; Upgrade affected PunBB deployments using vendor or project guidance.; Review the referenced upstream changeset before backporting any code fix..

Prepared

Jun 29, 2026, 06:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.