Mail Header Injection Vulnerability in MyBB Forum Software

CVE-2026-45125

What is CVE-2026-45125?

MyBB, an open source forum software, was found to have a mail header injection vulnerability prior to version 1.8.40. The Email User controller inadequately sanitizes the sender names provided via the fromname HTTP parameter, which can be utilized by guests or authenticated users with email-sending permissions. This lack of sanitization can lead to the injection of arbitrary headers into the Return-Path and Reply-To fields due to CRLF sequences when the mail_handler is configured to use the default PHP mail function. This vulnerability poses a risk of exploitation if left unaddressed, but it has been rectified in version 1.8.40.

References