Please do not post potential security vulnerabilities publicly. Instead, report them to the phpBB team. We take security very seriously and will respond to reports about potential security vulnerabilities as quickly as possible. There are multiple ways a potential security vulnerability can be reported:

• HackerOne: phpBB | Vulnerability Disclosure Program | HackerOne
• Create a report in the security tracker: Security Tracker
• Send an email: security@phpbb.com

Please provide as much detail as possible when reporting a vulnerability. You can expect to receive an update on your report within a few days. If the vulnerability is accepted, we will work on a fix and keep you informed of the progress. If the vulnerability is declined, we will provide an explanation.