CVE-2023-53979 | THREATINT

Description

MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attackers can modify upload path settings, upload a malicious PHP-embedded image file, and execute commands through the language configuration editing interface.

PUBLISHED Reserved 2025-12-20 | Published 2025-12-22 | Updated 2025-12-27 | Assigner VulnCheck

HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

MyBB 1.8.32

affected

Credits

lUc1f3r11 finder

References

www.cve.org/CVERecord?id=CVE-2022-45867

www.exploit-db.com/exploits/51213 (ExploitDB-51213) exploit

mybb.com/ (Official MyBB Vendor Homepage) product

fdlucifer.github.io/2023/01/17/mybb1-8-32-LFI-RCE/ (Researcher Disclosure) technical-description

www.vulncheck.com/...e-execution-via-chained-vulnerabilities (VulnCheck Advisory: MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities) third-party-advisory

cve.org (CVE-2023-53979)

nvd.nist.gov (CVE-2023-53979)

Download JSON