CVE-2026-29199
1 advisory.
Packagist/phpbb/phpbb CVE-2026-29199: high 8.1
phpBB has Password Reset Link Poisoning via Host Header injection
Action: Upgrade phpbb/phpbb to 3.3.16 or later.
composer require phpbb/phpbb:3.3.16composer require phpbb/phpbb:4.0.0-a2Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.3.16 | - |
| 4.0.0-a1 | 4.0.0-a2 | - |
Fixed versions
| 3.3.16 | 4.0.0-a2 |
Sources
- osv: GHSA-7gm6-w7mx-58cr
- https://nvd.nist.gov/vuln/detail/CVE-2026-29199
- https://hackerone.com/reports/3543246
- https://blog.phpbb.com/2026/04/27/phpbb-4-0-0-a2-release
- https://github.com/phpbb/phpbb-app
- https://www.phpbb.com/community/viewtopic.php?t=2671024
CVE-2026-29199 · published · modified · JSON