Description

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does not include the backslash character, allowing crafted input to escape the generated PHP string. The uniquely identifying implementation details include introduced in MyBB 1.8.13. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T16:17:06.493Z",
  "pubdate": "2026-08-18T16:17:06.493Z",
  "executiveSummary": "A PHP code injection vulnerability exists in the installer module of MyBB versions 1.8.13 through 1.8.39, leading to remote code execution.\nThe vulnerability allows an unauthenticated remote attacker to execute arbitrary PHP code on the underlying server if the installer script remains accessible.\nThe risk implication is critical, as successful exploitation results in full system compromise and unauthorized access to the hosting environment.\nThe attack capability requires network access to the installation interface and malicious manipulation of database configuration inputs during the installation or re-installation phase.",
  "technicalDetails": "The root cause of the vulnerability stems from improper input sanitization and string escaping within the installer module when writing user-supplied database configuration parameters directly to the application configuration file.\nSpecifically, the vulnerable component is install/index.php, which processes database configuration values using the PHP addcslashes() function.\nIntroduced in MyBB 1.8.13, the implementation flaw involves omitting the backslash character from the specified $characters argument passed to addcslashes().\nBecause the backslash character is not properly escaped, an attacker can supply crafted input containing backslashes and quotes that prematurely escape the generated PHP string literal within the configuration file.\nThis allows arbitrary PHP payload injection, which is subsequently evaluated and executed by the PHP interpreter when the configuration file is loaded or accessed.\nThe affected product is MyBB, specifically versions 1.8.13 up to 1.8.40.\nExploitation requires the installer interface (install/index.php) to be accessible on the network, which typically occurs during initial setup or when the installation directory is not removed post-installation.\nNo authentication or elevated privileges are required to interact with the exposed installer script, lowering the barrier to exploitation.\nThe post-exploitation impact includes arbitrary remote code execution under the privileges of the web server user, potential data exfiltration, database manipulation, and lateral movement within the network."
}