VulnerabilityAnalyzed

CVE-2025-48940

Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value.

HIGH 7.2EPSS 0.54%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlocked (no `install/lock` file present) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the forum has not yet been installed; or the attacker is authenticated as a forum administrator). MyBB 1.8.39 resolves this issue.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.54% probability · 44th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: mybb/mybb
Source: security-advisories@github.com

References

https://github.com/mybb/mybb/commit/6e6cfbd524d9101b51e1278ecf520479b64b0f00Patch
https://github.com/mybb/mybb/security/advisories/GHSA-q4jv-xwjx-37cpVendor Advisory
https://mybb.com/versions/1.8.39Product, Release Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.