CVE-2025-48940

Katalog CVE

CVSS 7.2 · High EPSS 0,54%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada mybb. Skor CVSS 3.1 7.2 (High) menurut github.com.

Deskripsi (NVD)

MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlocked (no `install/lock` file present) and the upgrade script must be accessible (by re-installing the forum via access to `install/index.php`; when the forum has not yet been installed; or the attacker is authenticated as a forum administrator). MyBB 1.8.39 resolves this issue.

Rincian

Terbit di NVD

2 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mybb/mybb/security/advisories/GHSA-q4jv-xwjx-37cp advisory vendor
• https://github.com/mybb/mybb/commit/6e6cfbd524d9101b51e1278ecf520479b64b0f00 patch
• https://mybb.com/versions/1.8.39 product · release notes