CVE-2026-45123

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.40

Description The remote requests feature does not correctly handle IPv6 addresses, leading to a server-side request forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. The default disallowed remote hosts list lacks IPv6 addresses, and the fetch remote file() function fails open when get ip by hostname() returns no result because it does not support IPv6 results. This allows a crafted remote target to bypass host restrictions via the inc/functions.php file.

Recommendations Update to version 1.8.40.