CVE-2025-48940

Description

MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlocked (no `install/lock` file present) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the forum has not yet been installed; or the attacker is authenticated as a forum administrator). MyBB 1.8.39 resolves this issue.

Reserved 2025-05-28 | Published 2025-06-02 | Updated 2025-06-02 | Assigner GitHub_M

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

< 1.8.39
affected

References

github.com/mybb/mybb/security/advisories/GHSA-q4jv-xwjx-37cp

github.com/...ommit/6e6cfbd524d9101b51e1278ecf520479b64b0f00

mybb.com/versions/1.8.39

cve.org (CVE-2025-48940)

nvd.nist.gov (CVE-2025-48940)

Download JSON