CVE-2025-48940

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlocked (no `install/lock` file present) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the forum has not yet been installed; or the attacker is authenticated as a forum administrator). MyBB 1.8.39 resolves this issue.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-489415.3MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which al CVE-2025-489426.5vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/comp CVE-2025-489436.5vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (CVE-2025-489446.5vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used CVE-2025-489458.2pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asyn CVE-2025-489463.7liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version CVE-2025-489477.7The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through CVE-2025-489486.5Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allow CVE-2025-489499.8Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to impro CVE-2025-48959.8A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This issue affects some CVE-2025-489508.8MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary CVE-2025-489519.3Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to inse