PT-2025-52716 · Mybb · Mybb

Luc1F3R11 · Published 2025-12-22 · Updated 2025-12-27 · CVE-2023-53979

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyBB version 1.8.32

Description MyBB version 1.8.32 contains a chained issue that allows authenticated administrators to bypass avatar upload restrictions and potentially execute arbitrary code. Attackers can modify upload path settings, upload a malicious PHP-embedded image file, and execute commands through the language configuration editing interface. The vulnerability involves bypassing restrictions on avatar uploads, which can lead to the execution of unauthorized code.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-53979

Affected Products

Mybb

References · 14

• 🔥 https://fdlucifer.github.io/2023/01/17/mybb1-8-32-LFI-RCE · Exploit
• 🔥 https://exploit-db.com/exploits/51213 · Exploit
• 🔥 https://vulncheck.com/advisories/mybb-authenticated-remote-code-execution-via-chained-vulnerabilities · Exploit
• https://cve.org/CVERecord?id=CVE-2022-45867 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-53979 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53979 · Vendor Advisory
• https://t.me/cveNotify/146945 · Telegram Post
• https://twitter.com/TheHackerWire/status/2003250118573674890 · Twitter Post
• https://mybb.com · Note
• https://twitter.com/CVEnew/status/2003233939457282155 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2003270430010814847 · Twitter Post
• https://t.me/CVEtracker/40447 · Telegram Post
• https://twitter.com/CveFindCom/status/2003233944909586801 · Twitter Post
• https://t.me/cveNotify/146896 · Telegram Post