Description

MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T16:17:07.383Z",
  "pubdate": "2026-08-18T16:17:07.383Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in MyBB prior to version 1.8.40 within the remote requests feature. The flaw arises from improper handling of IPv6 addresses and inadequate validation mechanisms in the remote file fetching logic. Specifically, the default disallowed remote hosts list fails to include IPv6 formats, and the verification routine fails open when host resolution fails.\nThis security deficiency allows an attacker to bypass host restrictions by leveraging crafted remote targets and unresolvable or IPv6-formatted hostnames. Consequently, unauthorized remote requests can be dispatched from the hosting server to internal or restricted network resources that would otherwise be blocked by security controls.\nThe vulnerability affects all MyBB deployments prior to version 1.8.40. Exploitation requires the ability to supply or influence parameters processed by the vulnerable remote requests subsystem, potentially enabling internal network reconnaissance, interaction with local services, or unauthorized data retrieval.\nRisk implications include potential exposure of internal infrastructure to external manipulation, unauthorized data access, and pivoting into internal network segments. Remediation requires upgrading the affected software to version 1.8.40, where the underlying address handling and verification logic are properly secured.",
  "technicalDetails": "The vulnerability resides in the remote requests feature implemented within inc/functions.php of MyBB prior to version 1.8.40. The core component responsible for processing remote targets is the fetch_remote_file() function, which fails to securely validate destination addresses against the disallowed remote hosts list when handling IPv6 infrastructure.\nThe root cause is twofold: first, the default disallowed remote hosts list does not account for IPv6 address representations; second, the verification check inside fetch_remote_file() implements a fail-open security posture. When the internal hostname resolution function get_ip_by_hostname() returns no result due to its inability to process IPv6 results, the validation logic incorrectly treats the absence of a resolution result as safe, bypassing the intended host restrictions.\nThe attack flow proceeds as follows: an attacker crafts a malicious input utilizing IPv6 notation or hostnames that yield no results under get_ip_by_hostname(). This input is supplied to the remote requests feature of MyBB. During the execution of fetch_remote_file(), the application attempts to validate the target against the disallowed hosts list. Because the input utilizes unsupported IPv6 formats or causes get_ip_by_hostname() to fail, the validation check fails open, bypassing the security controls.\nOnce the host restriction bypass is achieved, the application executes the outbound request to the specified target. Depending on the environment, this permits the server hosting MyBB to initiate requests against internal services, loopback interfaces (such as 127.0.0.1 or [::1]), or restricted cloud metadata endpoints. Authentication and privilege requirements depend on how the feature is exposed within the application context, but the network exposure involves the application server's ability to initiate outbound network connections."
}