CVE-2008-5418: Directory traversal vulnerability in login.php in the PunPortal module before 2.0 for PunBB allows remote a...

Security readout for executives and security teams

CVE-2008-5418 affects the legacy PunPortal module for PunBB before version 2.0. A remote attacker could abuse the language selection parameter to make login.php include and execute local files. This is potentially serious for any still-running public PunPortal deployment, but the source bundle does not show current active exploitation. Exposure is most likely limited to legacy PunBB sites using the PunPortal module before 2.0, especially where PunPortal login.php is reachable from the internet. Evidence is incomplete because the CVE bundle lists affected vendor, product, and CPE values as n/a. Prioritize discovery and containment of any internet-facing legacy PunPortal deployments. The business risk is concentrated but potentially high because successful exploitation could execute local files through a public login page. No active exploitation is proven in the supplied sources. Mitigation focus: Inventory PunBB deployments for the PunPortal module and installed version.; Check vendor or maintainer guidance for PunPortal 2.0 or later remediation.; Disable or remove PunPortal if it is unused or unsupported..

Prepared

Jun 28, 2026, 11:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.