View at Official ubuntu advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2018-19274 medium priority: Ubuntu including 1 source packages (phpbb3), 17 status rows across 17 suites (bionic, cosmic, disco, eoan, focal, groovy, hirsute, impish, jammy, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 14, released 2, needed 1.
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.