Summary
CVE-2026-45117 is a code injection (RCE) vulnerability in the MyBB forum software’s web-based installer, affecting versions 1.8.13 through 1.8.39. Improper sanitization of user-supplied database configuration values allows an attacker to inject arbitrary PHP code into the generated configuration file, leading to remote code execution. The flaw carries a CVSS v3.1 base score of 9.8 (Critical) and requires no authentication or user interaction.
Technical details
- Root cause: the MyBB installer writes user-supplied database configuration values (e.g., database name/host/credentials) directly into a generated PHP configuration file.
- MyBB 1.8.13 added
addcslashes()sanitization to prevent installer RCE, but the character set passed toaddcslashes()did not include the backslash (“) character. - This omission allows an attacker to craft input containing a backslash that escapes the PHP string context in the generated config file, injecting arbitrary PHP code.
- Attack vector is network-based, requires no privileges and no user interaction, and is exploitable when the installer (
install/) is reachable and can be run or re-run. - Successful exploitation results in arbitrary PHP code execution on the host, giving full compromise of confidentiality, integrity, and availability.
Affected software
- MyBB versions 1.8.13 through 1.8.39 (inclusive)
- Fixed in MyBB 1.8.40
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade MyBB to version 1.8.40 or later, which corrects the
addcslashes()character set used during installer sanitization. - If patching is not immediately possible: Remove or restrict access to the
install/directory after installation/upgrade is complete, since the installer should not remain accessible on a production forum. - As a general precaution, back up forum files and the database before applying the upgrade, and verify the installer directory is deleted or blocked from external access following any install or upgrade.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Raw response body:
<a title="Powered By MyBB - Rendered page (JavaScript object present at runtime):
MyBB

