XenForo 2.3 Security Fixes Add-on
Backports XenForo security fixes to earlier 2.3.x installs, without an upgrade and without editing any core files. It closes 18 issues purely through class extensions: the 14 released in 2.3.13, plus four more that were fixed upstream in 2.3.5, 2.3.7, 2.3.9 and 2.3.10.
Those 14 are the same set XenForo shipped to every branch in the cumulative 2.2.0–2.3.12 security update. The other four matter because XenForo's patch for an old branch does not include them: if you are on 2.3.3, the official 2.3.3 patch gives you the 14, but the 2.3.5, 2.3.7, 2.3.9 and 2.3.10 fixes only arrive by upgrading. This add-on gives you all of them.
Runtime tested on XenForo 2.3.3. Extension points and the two methods that reimplement core logic were additionally verified against the 2.3.9 source.
What it fixes
From 2.3.13:
Backported from later 2.3.x releases:
Each of these is written to do nothing on an install that already has the upstream fix, so the add-on is safe to leave enabled across 2.3.x.
Install
No core files are modified. Uninstalling removes every change.
Optional manual patch
The download also contains a
That one cannot be fixed by an add-on. The affected code is a static utility method and a class built without going through the extension system, so there is nowhere to hook in. The folder contains a patch file, hand-edit instructions, and a read-only checker script that tells you which changes your install is missing.
These are core file edits and are lost on every XenForo upgrade, so they are entirely optional and kept out of the add-on itself.
Scope
Requires XenForo 2.3.0 or later. It does not cover 2.2.x, and it does not cover XenForo Media Gallery, which is a separate product with its own updates.
Note: Upgrading to XenForo 2.3.13+ remains the recommended long term fix. This add-on is for boards that cannot upgrade yet. Always test on a staging copy before production.
Credit
The 14 vulnerabilities listed under "From 2.3.13" were discovered and documented by Marco Paciaroni (BomboBombone).
https://github.com/BomboBombone
The 2.3.5, 2.3.7, 2.3.9 and 2.3.10 issues come from separate XenForo security releases and are not his findings.
Backports XenForo security fixes to earlier 2.3.x installs, without an upgrade and without editing any core files. It closes 18 issues purely through class extensions: the 14 released in 2.3.13, plus four more that were fixed upstream in 2.3.5, 2.3.7, 2.3.9 and 2.3.10.
Those 14 are the same set XenForo shipped to every branch in the cumulative 2.2.0–2.3.12 security update. The other four matter because XenForo's patch for an old branch does not include them: if you are on 2.3.3, the official 2.3.3 patch gives you the 14, but the 2.3.5, 2.3.7, 2.3.9 and 2.3.10 fixes only arrive by upgrading. This add-on gives you all of them.
Runtime tested on XenForo 2.3.3. Extension points and the two methods that reimplement core logic were additionally verified against the 2.3.9 source.
What it fixes
From 2.3.13:
- OAuth2 token endpoint: empty client_secret / code_verifier bypass, redirect_uri not bound to the code, authorization-code replay, and refresh-token replay after access-token expiry. (CVE-2026-73309, 73310, 73311, 73312)
- Passkey two-step login: the passkey was not bound to the account logging in, allowing an MFA bypass after a password compromise. (CVE-2026-73313)
- PayPal REST webhooks: signature verification failing open on an unknown algorithm, SSRF via the certificate URL, and webhook/transaction replay. (CVE-2026-73314, 73315, 73316)
- Approval queue: a limited admin could run the approval job through the ACP cache-rebuild dispatcher and approve content as another user. (CVE-2026-73317)
- Force agreement: the privacy-policy / terms re-agreement actions were missing their permission check. (CVE-2026-73318)
- Dynamic redirect XSS: a "javascript:" URL was accepted as a same-host redirect and assigned to window.location. (CVE-2026-73319)
- Unfurl disclosure: an unauthenticated endpoint leaked pending rich-link previews by predictable ID. (CVE-2026-73320)
- BBCode DoS: deeply nested BBCode could crash a PHP worker through uncontrolled recursion. (CVE-2026-73321)
- Style archive path traversal: a Windows "..\" traversal in the style-archive importer. (CVE-2026-74239)
Backported from later 2.3.x releases:
- OAuth2 scope escalation (2.3.5): allowed scopes are stored as a plain list, so the lookup compared a string column against integers. MySQL casts every non-numeric scope ID to 0, which matched every scope row, and a client was granted any scope it asked for.
- Account page caching (2.3.7): account pages carry personal data but were served with no cache directive, so a browser or proxy could keep a copy.
- BBCode table XSS (2.3.9): the width option of
[TABLE]and[TD]was written into a style attribute unescaped, so a crafted width broke out and injected markup. - HTML placeholder bypass (2.3.10): placeholder markers were stripped in a single pass, so crafted input could splice leftover bytes back into a fresh placeholder and survive.
Each of these is written to do nothing on an install that already has the upstream fix, so the add-on is safe to leave enabled across 2.3.x.
Install
- Back up your database and files first.
- Upload the contents of
upload/into your board root, so thatsrc/addons/SecurityFixes/XF23/exists. - Install "XenForo 2.3 Security Fixes" from the ACP add-on list (or via CLI:
php cmd.php xf:addon-install SecurityFixes/XF23). - Verify: go to Tools → Class extensions and check that the fourteen extensions are listed as active.
No core files are modified. Uninstalling removes every change.
Optional manual patch
The download also contains a
manual-patch-2.3.7/ folder. XenForo 2.3.7 tightened which methods a template is allowed to call: the old check matched its whitelist case-insensitively and with no word boundary, so any method merely starting with an allowed prefix counted as read-only. Reaching it requires the template admin permission, so it is an admin-level issue rather than something a normal member can touch.That one cannot be fixed by an add-on. The affected code is a static utility method and a class built without going through the extension system, so there is nowhere to hook in. The folder contains a patch file, hand-edit instructions, and a read-only checker script that tells you which changes your install is missing.
These are core file edits and are lost on every XenForo upgrade, so they are entirely optional and kept out of the add-on itself.
Scope
Requires XenForo 2.3.0 or later. It does not cover 2.2.x, and it does not cover XenForo Media Gallery, which is a separate product with its own updates.
Note: Upgrading to XenForo 2.3.13+ remains the recommended long term fix. This add-on is for boards that cannot upgrade yet. Always test on a staging copy before production.
Credit
The 14 vulnerabilities listed under "From 2.3.13" were discovered and documented by Marco Paciaroni (BomboBombone).
https://github.com/BomboBombone
The 2.3.5, 2.3.7, 2.3.9 and 2.3.10 issues come from separate XenForo security releases and are not his findings.
