What is the CVSS score of CVE-2026-45117?

CVE-2026-45117 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

How to fix or mitigate CVE-2026-45117?

Within 24 hours: audit all MyBB instances to identify vulnerable versions (1.8.13-1.8.39) and confirm whether install/index.php is externally reachable; immediately block access to the install/ directory using web server rules or firewall controls to prevent exploitation. Within 7 days: if the installer is no longer needed, delete the install/ directory entirely; if installation remains incomplete, restrict access to internal networks only and require separate administrative authentication. Within 30 days: plan and execute upgrade to MyBB 1.8.40 or later, or transition to an actively maintained content management system if timely patching cannot be achieved.

MyBB CVE-2026-45117

Q: Which versions of MyBB are affected by CVE-2026-45117?

MyBB versions 1.8.13 through 1.8.39 contain a critical remote code execution vulnerability (CVE-2026-45117, CVSS 9.8) exploitable through publicly accessible web-based installer endpoints.. A patch is available.

EUVD-2026-61020 CRITICAL

Code Injection (CWE-94)

2026-08-18 GitHub_M

PHP RCE Code Injection Mybb

9.8

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Locate exposed MyBB installer
Delivery

Submit crafted DB config value with backslash
Exploit

Escape single-quoted PHP string in config.php
Execution

Inject arbitrary PHP
Persist

Config included on page load
Impact

Execute code as web server

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the web installer (install/index.php) to be reachable over HTTP - typically during initial setup, or on servers where the install/ directory was not deleted or locked after installation. The attacker must be able to submit database configuration values (dbengine, dbname, tableprefix, dbhost, dbuser, dbpass, or encoding) to the installer and must supply input containing a backslash to escape the single-quoted PHP string. Affected versions are strictly 1.8.13 through 1.8.39. The primary limiting factor is installer availability: a fully installed, properly hardened MyBB forum (install/ removed or locked) is not exploitable, so this is not a default-configuration RCE against a live, completed installation despite the AV:N/AC:L/PR:N/UI:N vector.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes an unauthenticated, network, low-complexity full-compromise RCE, which drives the 9.8 score. However, the raw score is materially tempered by a critical precondition the vector does not capture: the installer must be reachable. MyBB installations normally lock or require removal of the install/ directory after setup, so in a correctly deployed forum the vulnerable code path is unreachable, making this primarily a threat during initial installation or on servers where install/ was never removed/locked. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; there is no evidence of active exploitation. In practice this is a genuine critical-severity bug but its real-world exploitability is gated by whether the installer remains exposed - a configuration-dependent condition rather than a universally exploitable default.
Exploit ScenarioDerived	An attacker discovers a MyBB server where the install/ directory was never removed (mid-installation or misconfigured deployment) and submits the installer's database configuration form with a crafted value containing a trailing backslash and appended PHP. The malformed value breaks out of the single-quoted string in the generated inc/config.php, so the injected PHP executes on every subsequent page load, giving the attacker code execution on the web server. No public POC is referenced, but the single-line fix commit clearly demonstrates the injection mechanics.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 18, 2026

Remote code execution in MyBB 1.8.13 through 1.8.39 lets an attacker inject arbitrary PHP into the generated database configuration file when the web-based installer (install/index.php) remains accessible. The installer sanitizes database configuration values with addcslashes() but omits the backslash from its escaped-character set, so crafted input can break out of the single-quoted PHP string and execute attacker-controlled code. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit publicly reveals the exact one-character root cause, lowering the barrier to weaponization.

RemediationAI

Vendor-released patch: MyBB 1.8.40 - upgrade to this version, which changes the addcslashes() escape set from "'" to "\\'" so the backslash is escaped (fix commit 0fe713e3b964bfc878ea65bdd9f746f585f6ebbf, https://github.com/mybb/mybb/releases/tag/mybb_1840). As an immediate compensating control on already-installed forums, delete or web-block the install/ directory (e.g. remove install/index.php or deny HTTP access to /install/), which fully removes the vulnerable code path with no impact on a completed installation; MyBB already recommends removing/locking this directory post-setup. If a fresh install is in progress and cannot yet be upgraded, restrict network access to the installer to trusted admin IPs until 1.8.40 is applied. Review advisory GHSA-gpc4-77rp-3xqr for details.

Affected VersionsENISA

MyBB < 1.8.40

Affected Packages

euvd mybb fix: 1.8.40

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

MyBB is a widely used open-source PHP forum application. The flaw is a CWE-94 (Code Injection) issue in the installer's create_tables() routine, which writes user-supplied database settings (type, database name, table prefix, hostname, username, password, encoding) into inc/config.php as single-quoted PHP string literals. The values are passed through addcslashes($value, "'") - a $characters argument introduced in MyBB 1.8.13 that escapes the single quote but not the backslash. Because a trailing backslash in the input is not itself escaped, it consumes the intended closing quote's escape and lets the attacker terminate the string and append arbitrary PHP, which is later executed when config.php is included. The CPE cpe:2.3:a:mybb:mybb identifies the affected component as the MyBB application itself.

Know when Mybb gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.1 HIGH

Network unauthenticated RCE, but AC:H reflects the required non-default precondition that the installer remains reachable; full compromise gives C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 18, 2026 - 17:17 EUVD

CVE Published

Aug 18, 2026 - 15:53 cve.org

CRITICAL 9.8

DescriptionCVE.org

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does not include the backslash character, allowing crafted input to escape the generated PHP string. The uniquely identifying implementation details include introduced in MyBB 1.8.13. This issue is fixed in version 1.8.40.

Executive ViewAI

Why It Matters

MyBB versions 1.8.13 through 1.8.39 contain a critical remote code execution vulnerability (CVE-2026-45117, CVSS 9.8) exploitable through publicly accessible web-based installer endpoints. Organizations running vulnerable versions with exposed installers face imminent risk of unauthorized system access and data compromise. No vendor patch is available, requiring immediate interim protective measures.

Business Impact: Severe

Compensating Controls

Remove or disable the install/index.php endpoint via filesystem deletion or web server configuration (Apache .htaccess, Nginx location directives, or firewall rules). For installations where the installer cannot be deleted, enforce strict access control policies restricting access to internal networks only. Deploy monitoring on web server logs to detect requests to install/ paths and trigger alerts for investigation.

Threat Intelligence Overview

EPSS Score

0.8%

Top 46% exploitable

Prevalence

Medium

popular open-source PHP forum software, common but not ubiquitous

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.8%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.