Vulnerability · Published Jun 2, 2025 · Assigned by GitHub_M

CVE-2025-48940MyBB's upgrade component vulnerable to local file inclusion

High 7.2

In plain English

A high-severity path traversal in mybb from mybb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.6%top 52.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlocked (no `install/lock` file present) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the forum has not yet been installed; or the attacker is authenticated as a forum administrator). MyBB 1.8.39 resolves this issue.

Affected products (as reported)

Vendor	Product	Versions
mybb	mybb	< 1.8.39

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/mybb/mybb/security/advisories/GHSA-q4jv-xwjx-37cp x_refsource_CONFIRM
https://github.com/mybb/mybb/commit/6e6cfbd524d9101b51e1278ecf520479b64b0f00 x_refsource_MISC
https://mybb.com/versions/1.8.39 x_refsource_MISC