CVE-2026-45117: MyBB: Installer database configuration RCE
MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does not include the backslash character, allowing crafted input to escape the generated PHP string. The uniquely identifying implementation details include introduced in MyBB 1.8.13. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBBto a version that resolves this vulnerability.Fixed in 1.8.40
Event History
Frequently Asked Questions
Which MyBB versions are affected and which version contains the fix?
MyBB installations running versions 1.8.13 through 1.8.39 are affected if the installer remains available. Version 1.8.40 fixes the issue.
What conditions are required for exploitation?
An attacker can exploit the issue remotely without privileges or user interaction, but the installer must be available. Exploitation uses crafted database configuration values to escape a generated PHP string and inject PHP code into the configuration file.
What should be done if immediate patching is not possible?
Upgrade to MyBB 1.8.40. If upgrading cannot happen immediately, ensure the installer is not available, since installer availability is required for the described attack path.