---
id: CVE-2026-48613
title: >-
  SQL injection vulnerability in phpBB profile field migration due to improper
  handling of user-supplied profile field data during migration, allowing
  execution of arbitrary SQL queries
summary: >-
  SQL injection vulnerability in phpBB profile field migration due to improper
  handling of user-supplied profile field data during migration, allowing
  execution of arbitrary SQL queries. Only applies to phpBB forums that had been
  updated f…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L'
cwe:
  - CWE-89
vendor: phpBB
product: phpBB
affected:
  - phpBB >= 3.3.8 <= 3.3.16
published: '2026-06-12'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:17:45.407'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48613'
references:
  - url: 'https://www.phpbb.com/community/viewtopic.php?t=2672170'
    label: support@hackerone.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-06-23T03:55:38.817707Z'
scores:
  nvd: 5.9
  cna: 7.1
epss: 0.00155
epssPercentile: 0.04679
ingestedAt: '2026-11-05T06:38:03.618Z'
---

## Overview

SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL queries. Only applies to phpBB forums that had been updated from versions prior to phpBB 3.3.8 and have not been updated to 3.3.11 or newer yet.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.