PHP Code Injection Vulnerability in MyBB Forum Software
CVE-2026-45117

9.8CRITICAL

Key Information:

Vendor

Mybb

Status
Mybb
Vendor
CVE Published:
18 August 2026

What is CVE-2026-45117?

The MyBB forum software, versions 1.8.13 through 1.8.40, contains a vulnerability in the installer module that allows improper escaping of user-supplied database configuration values. This oversight can lead to PHP code injection, enabling remote code execution if the installer is accessible. Specifically, the flawed implementation in the addcslashes() function allows crafted input to escape the generated PHP string. MyBB has resolved this issue in version 1.8.40.

Affected Version(s)

mybb < 1.8.40

References

https://github.com/mybb/mybb/security/advisories/GHSA-gpc...
x_refsource_CONFIRM
https://github.com/mybb/mybb/commit/0fe713e3b964bfc878ea6...
x_refsource_MISC
https://github.com/mybb/mybb/releases/tag/mybb_1840
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.