[GHSA-7gm6-w7mx-58cr] phpBB before 3.3.16 is vulnerable to Host Header...

[marc1706]

Updates

• Affected products
• Summary

Comments
I'm lead developer of phpBB and created this CVE via Hackerone.
See also the following announcements:
https://www.phpbb.com/community/viewtopic.php?t=2671024
https://blog.phpbb.com/2026/04/27/phpbb-4-0-0-a2-release/

[Copilot]

Pull request overview

Adds affected package ranges and a summary to advisory GHSA-7gm6-w7mx-58cr for a phpBB Host Header Injection vulnerability leading to password reset link poisoning.

Changes:

• Adds a summary field describing the vulnerability.
• Populates the previously empty affected array with two Packagist ranges for phpbb/phpbb (3.0.0–3.3.16 and 4.0.0-a1–4.0.0-a2).
• Bumps the modified timestamp.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[marc1706]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

I don't see anything waiting on me? Maybe someone at GitHub can get their copilot agent to check their notifications to tell them that there is an open task?

[advisory-database]

Hi @marc1706! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!