MyBB vulnerabilities
We track 14 vulnerabilities in MyBB products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on August 18, 2026.
Latest MyBB vulnerabilities
- 9.3 Critical severity
mybb: Improper Neutralization of Script in Attributes in a Web Page
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the fro
- 9.8 Critical severity
mybb: Improper Control of Generation of Code
MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when t
- 8.7 High severity
mybb: Improper Neutralization of Input During Web Page Generation
MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs th
- 8.7 High severity
mybb: Improper Neutralization of Input During Web Page Generation
MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the
- 8.8 High severity
MyBB: Improper Limitation of a Pathname to a Restricted Directory
MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attackers can modify upload path settings, upload a malicious PHP-embedded image file, and execute commands t
- 7.2 High severity
mybb: Improper Limitation of a Pathname to a Restricted Directory
MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vul
- 7.6 High severity
Mybb: Server-Side Request Forgery
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.
- 7.6 High severity
Mybb: Server-Side Request Forgery
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.
- 7.6 High severity
Mybb: Server-Side Request Forgery
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.
- 7.6 High severity
Mybb: Server-Side Request Forgery
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.
- 7.2 High severity
Mybb: Improper Control of Generation of Code
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.
- 7.2 High severity
Mybb: Improper Limitation of a Pathname to a Restricted Directory
MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inclusion and execution.
- 7.2 High severity
mybb: Improper Neutralization of Special Elements used in a Command
MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information
- 7.2 High severity
mybb: Improper Control of Generation of Code
MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed