CVE-2025-48940

MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlocked (no `install/lock` file present) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the forum has not yet been installed; or the attacker is authenticated as a forum administrator). MyBB 1.8.39 resolves this issue.

• CWE-22

• https://github.com/mybb/mybb/commit/6e6cfbd524d9101b51e1278ecf520479b64b0f00Patch
• https://github.com/mybb/mybb/security/advisories/GHSA-q4jv-xwjx-37cpVendor Advisory
• https://mybb.com/versions/1.8.39Product, Release Notes

Published

Jun 2, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48935Deno is a JavaScript, TypeScript, and WebAssembly runtime. S…9.1
• CVE-2025-48936Zitadel is open-source identity infrastructure software. Pri…8.8
• CVE-2025-48937matrix-rust-sdk is an implementation of a Matrix client-serv…4.9
• CVE-2025-48938go-gh is a collection of Go modules to make authoring GitHub…9.8
• CVE-2025-48939tarteaucitron.js is a compliant and accessible cookie banner…4.2
• CVE-2025-4894A vulnerability classified as problematic was found in calmk…5.9
• CVE-2025-48941MyBB is free and open source forum software. Prior to versio…5.3
• CVE-2025-48942vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48943vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48944vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48945pycares is a Python module which provides an interface to c-…8.2
• CVE-2025-48946liboqs is a C-language cryptographic library that provides i…3.7