CVE-2025-29457: SSRF

Published Apr 17, 2025

Updated

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

Affected Software

2 affected components

MyBB Group MyBB

MyBB MyBB=1.8.38

Event History

Apr 17, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-29457?

CVE-2025-29457 has been classified with a moderate severity level, indicating a risk of sensitive information exposure.

How do I fix CVE-2025-29457?

To fix CVE-2025-29457, update your MyBB installation to the latest version to eliminate the vulnerability.

Who is affected by CVE-2025-29457?

CVE-2025-29457 affects all installations of MyBB version 1.8.38 and earlier.

What details can an attacker obtain through CVE-2025-29457?

An attacker can retrieve sensitive information from the server by exploiting the Import a Theme function in MyBB.

Is there a workaround for CVE-2025-29457?

As a temporary workaround for CVE-2025-29457, users can disable the Import a Theme functionality until the software is updated.