CVE-2008-2028: miniBB 2.2, and possibly earlier, when register_globals is enabled, allows remote attackers to obtain the f...

Security readout for executives and security teams

CVE-2008-2028 is an information disclosure issue in miniBB 2.2, and possibly earlier versions, when PHP register_globals is enabled. A remote user can trigger an error that reveals the server filesystem path. This is not described as direct system compromise, but exposed paths can help attackers plan follow-on attacks. Exposure is likely limited to legacy miniBB 2.2 or possibly earlier installations running with register_globals enabled and publicly reachable registration functionality. Organizations not running miniBB, or running without register_globals, are not indicated as affected by the provided sources. Handle during legacy web application cleanup unless miniBB is internet-facing or sits on sensitive infrastructure. The issue is low direct impact, but it can improve attacker reconnaissance and signals outdated PHP-era deployment risk. Mitigation focus: Identify any public miniBB 2.2 or older deployments.; Disable PHP register_globals where it is still enabled.; Check miniBB vendor guidance for fixed versions or configuration advice..

Prepared

Jun 28, 2026, 19:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.