Unauthenticated attackers can extract sensitive server directory structures from XenForo installations due to improper error handling in exception messages.

This vulnerability (CWE-209) involves the disclosure of internal filesystem paths through exception messages triggered by open_basedir restrictions. The flaw is remotely exploitable by an unauthenticated attacker without requiring user interaction.

The exposure of server directory structures provides an attacker with critical reconnaissance data that simplifies the planning of further attacks, such as targeted file inclusion or local file access attempts. While the CVSS score of 7.5 reflects a high severity due to the ease of exploitation and lack of authentication requirements, the primary risk involves reconnaissance rather than direct code execution. Unauthorized access to server metadata can lead to broader security compromises and compromise the integrity of the hosting environment.

Immediate Action: Update the XenForo installation to version 2.3.7 or later to resolve the information disclosure flaw.

Proactive Monitoring: Monitor web server error logs for recurring exceptions or unusual path disclosure patterns that may indicate automated scanning or reconnaissance activity.

Compensating Controls: Ensure that PHP configurations are hardened to suppress verbose error reporting in production environments, preventing sensitive information from being displayed to the end user.

Public Exploit Available: No — exploit_available (false).

This vulnerability represents a significant information leakage risk that facilitates deeper exploitation of the host server. Administrators should prioritize upgrading to XenForo 2.3.7 immediately to ensure sensitive path information is no longer exposed to unauthenticated parties. Failure to patch may allow attackers to map the server environment, increasing the risk of more severe attacks targeting specific files or configurations.