PatchTheCVECVE-2023-5917: A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10
CVE-2023-5917 is a low-severity flaw (CVSS 2.4) affecting phpbb. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recomm
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 2.4 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.5% (top 55%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2023-11-02 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-5917?
phpbb: upgrade to 3.3.11. Exact commands for each OS are on this page.
Is CVE-2023-5917 being exploited?
CVE-2023-5917 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-5917 affect?
CVE-2023-5917 affects phpbb. Severity is low (CVSS 2.4). A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argu
How urgent is CVE-2023-5917?
Priority 20/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2026-29199 HIGH 8.1 UPGRADE phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning
- CVE-2025-70811 MEDIUM 4.3 DOWNGRADE Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary
- CVE-2025-70810 HIGH 8.8 DOWNGRADE Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary
- CVE-2020-8226 MEDIUM 5.8 UPGRADE A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to
- CVE-2020-5502 MEDIUM 6.5 DOWNGRADE phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.