CVE-2026-49954 is a local file inclusion vulnerability in Discuz! X5.0 (releases from 20260320 through 20260501). It arises from improper control of filenames used in include/require statements when importing plugin configurations. Authenticated administrators can import a specially crafted plugin configuration containing path traversal sequences in the directory attribute. During plugin installation, an exception can be triggered that bypasses sanitization, allowing malicious paths to be stored unsanitized and later passed to PHP's include() function. Combined with file upload functionality, this enables arbitrary code execution in the context of the web server user.

Successful exploitation allows an authenticated administrator to execute arbitrary code on the server running Discuz! X5.0. This can lead to full compromise of the web server environment under the web server user privileges. The vulnerability requires administrator privileges but does not require user interaction and has a network attack vector, making it a significant risk in environments where administrator credentials are compromised or misused.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor plugin import activities closely. Avoid importing plugins from untrusted sources. Follow vendor advisories for updates on patches or official mitigations.