PT-2025-23535 · Mybb · Mybb

Cillian Collins · Published 2025-06-02 · Updated 2025-06-25 · CVE-2025-48940

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.39

Description The issue affects MyBB, free and open source forum software. It is caused by the upgrade component not validating user input properly, allowing attackers to perform local file inclusion (LFI) via a specially crafted parameter value. To exploit this, the installer must be unlocked and the upgrade script must be accessible, which can happen if the forum is re-installed via access to install/index.php, when the forum has not yet been installed, or the attacker is authenticated as a forum administrator.

Recommendations For versions prior to 1.8.39, update to version 1.8.39 to resolve the issue. As a temporary workaround, consider restricting access to the upgrade script and ensuring the installer is locked by creating an install/lock file to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-48940

GHSA-Q4JV-XWJX-37CP

Affected Products

Mybb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48940.json · Exploit
• https://github.com/mybb/mybb/commit/6e6cfbd524d9101b51e1278ecf520479b64b0f00 · Patch
• https://github.com/mybb/mybb/security/advisories/GHSA-q4jv-xwjx-37cp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48940 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48940 · Vendor Advisory
• https://mybb.com/versions/1.8.39 · Note
• https://twitter.com/transilienceai/status/1937730750306009289 · Twitter Post
• https://t.me/cvetracker/25194 · Telegram Post
• https://twitter.com/CVEnew/status/1929573751454146677 · Twitter Post
• https://t.me/latest_high_impact_cve/2520 · Telegram Post