Local File Inclusion in MyBB Forum Software by MyBB Group

CVE-2025-48940

What is CVE-2025-48940?

MyBB, an open-source forum software, has a vulnerability that allows for local file inclusion (LFI) due to inadequate validation of user input in the upgrade component prior to version 1.8.39. This flaw can be exploited if the install environment is compromised, allowing attackers to manipulate parameters to gain access to sensitive files. Successful exploitation requires that the installer is not locked, and that administrative privileges are granted to the attacker, which can involve actions like re-installing the forum. It is crucial for users to upgrade to version 1.8.39 or later to mitigate this vulnerability and secure their forum applications.

References