CVE-2026-45117

creationtimestamp| type| source ---|---|--- 2026-08-18 18:09:29+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtess267kd2y 2026-08-18 18:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtest5id6p2p...

CVE-2026-45117

MyBB 1.8.13 through 1.8.39's installer module (install/index.php) uses addcslashes() without including backslash in the character list, letting crafted database config values escape the generated PHP string for code injection and RCE. Fixed in 1.8.40; no in-the-wild exploitation reported.

CVE-2026-45117 MyBB: Installer database configuration RCE

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...

CVE-2026-45117 MyBB: Installer database configuration RCE

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...