CVE-2026-45117
CriticalCVSS 9.8Summary
MyBB from version 1.8.13 to 1.8.40 contains a vulnerability in the installer module that improperly escapes database configuration values, leading to PHP code injection and remote code execution.
Risk Assessment
The vulnerability allows an attacker to execute arbitrary code on the server, potentially leading to full system compromise.
Recommendation
It is recommended to update MyBB to version 1.8.40 or later and remove or secure the installer file.
Original NVD description (English source)
MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does not include the backslash character, allowing crafted input to escape the generated PHP string. The uniquely identifying implementation details include introduced in MyBB 1.8.13. This issue is fixed in version 1.8.40.