CVE-2013-2057: YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability

Security readout for executives and security teams

YaBB forum software through version 2.5.2 is reported vulnerable to local file inclusion through the guestlanguage cookie parameter. If an old YaBB instance is still online, attackers may be able to make the application include files from the server. The public bundle does not provide severity scoring, confirmed exploitation, or a named fixed version. Exposure is limited to environments running YaBB through 2.5.2, especially public forum deployments. Organizations without YaBB, or with newer versions outside the cited range, are not shown affected by the supplied bundle. Prioritize as a legacy exposure check, not an emergency exploitation response based on the supplied evidence. Any internet-facing YaBB through 2.5.2 should be upgraded, isolated, or retired because local file inclusion can expose sensitive server-side data. Mitigation focus: Inventory public and internal systems for YaBB installations.; Confirm whether any instance is version 2.5.2 or earlier.; Check YaBB vendor or maintainer guidance for fixed versions or workarounds..

Prepared

Jun 6, 2026, 02:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.