MEDIUM4.3

GHSA-wg24-9xm9-593v

phpBB Cross-Site Request Forgery (CSRF)

Quick fix

GHSA-wg24-9xm9-593v — phpbb/phpbb: upgrade to the fixed version with the command below.

composer require phpbb/phpbb:^3.2.8

Details

Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.

Enter the version of the package you're using.

Introduced in: 3.2.7Fixed in: 3.2.8

Fixcomposer require phpbb/phpbb:^3.2.8