CVE-2005-0259: Phpbb Group Phpbb

Medium severity, CVSS 6.4. EPSS: 2% chance of exploitation in the next 30 days.

phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local users to read arbitrary files by providing both a local and remote location for an avatar, then modifying the "Upload Avatar from a URL:" field to reference the target file.

Affected products

• Phpbb Group Phpbb: version 2.0.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; version 2.0.4 only; version 2.0.5 only; …

Published 2005-03-14. Last modified 2026-06-16.