CVE - CVE-2025-48940

CVE-ID
CVE-2025-48940	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlocked (no `install/lock` file present) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the forum has not yet been installed; or the attacker is authenticated as a forum administrator). MyBB 1.8.39 resolves this issue.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/mybb/mybb/commit/6e6cfbd524d9101b51e1278ecf520479b64b0f00 URL:https://github.com/mybb/mybb/commit/6e6cfbd524d9101b51e1278ecf520479b64b0f00 MISC:https://github.com/mybb/mybb/security/advisories/GHSA-q4jv-xwjx-37cp URL:https://github.com/mybb/mybb/security/advisories/GHSA-q4jv-xwjx-37cp MISC:https://mybb.com/versions/1.8.39 URL:https://mybb.com/versions/1.8.39
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20250528	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250528)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)