CVE-2026-45117

Name of the Vulnerable Software and Affected Versions MyBB versions 1.8.13 through 1.8.39

Description The installer module fails to properly escape user-supplied database configuration values written to the configuration file. This occurs because the addcslashes() function in the 'install/index.php' endpoint does not include the backslash character in its $characters argument, allowing crafted input to escape the generated PHP string. This leads to PHP code injection and remote code execution when the installer is available.

Recommendations Update to version 1.8.40. As a temporary mitigation, restrict access to the 'install/index.php' endpoint or remove the installer module from the server.