CVE-2025-48940 MyBB's upgrade component vulnerable to local file inclusion
Attackers can perform local file inclusion in MyBB's upgrade component if the installer is unlocked or accessible, potentially reading sensitive files.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-48940?
CVE-2025-48940 is a high-severity path traversal vulnerability in Mybb Mybb, published on 2 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlocked (no `install/lock` file present) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the forum has not yet been installed; or the attacker is authenticated as a forum administrator). MyBB 1.8.39 resolves this issue.
Weakness: CWE-22
Which versions are affected by CVE-2025-48940?
It affects 1 product.
Products include Mybb Mybb.
How do I fix CVE-2025-48940?
No fix has been published for CVE-2025-48940 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-48940 being exploited?
There is no known exploitation of CVE-2025-48940 in the wild and no public exploit code.
Other vulnerabilities in Mybb Mybb
Sources
Also known as GHSA-q4jv-xwjx-37cp.