Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserial...

References

• advisory https://lists.debian.org/debian-lts-announce/2018/11/msg00029.html
• patch https://www.phpbb.com/community/viewtopic.php?f=14&t=2492206
• report https://blog.ripstech.com/2018/phpbb3-phar-deserialization-to-remote-code-execution/