CVE-2026-45117: MyBB Forum Software RCE Vulnerability

CVE-2026-45117 Overview

CVE-2026-45117 is a PHP code injection vulnerability in MyBB, an open source forum software. The flaw resides in the installer module (install/index.php), which fails to properly escape user-supplied database configuration values before writing them to the generated PHP configuration file. Affected versions span from 1.8.13 through 1.8.39, with a fix released in 1.8.40. The vulnerability is classified as [CWE-94] Improper Control of Generation of Code and enables unauthenticated remote code execution when the installer is reachable.

Critical Impact
Attackers can inject arbitrary PHP into the MyBB configuration file and achieve remote code execution on servers where the installer remains accessible.

Affected Products

MyBB versions 1.8.13 through 1.8.39
MyBB installer module (install/index.php)
Deployments where the installer directory has not been removed or restricted

Discovery Timeline

2026-08-18 - CVE-2026-45117 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45117

Vulnerability Analysis

MyBB's installer generates a PHP configuration file that embeds several values supplied by the user during setup, including the database character encoding. To make these values safe for inclusion inside a single-quoted PHP string, the installer calls addcslashes() on each value. The intent is to escape any characters that could break out of the string literal and inject arbitrary PHP.

The defect is in the second argument to addcslashes(). Starting in MyBB 1.8.13, the $characters argument was set to "'", which escapes only the single-quote character. It does not include the backslash. An attacker who supplies input containing a backslash followed by a single quote can defeat the escaping. addcslashes() prefixes the single quote with a backslash, but the attacker-supplied backslash immediately before the added backslash pairs with it, leaving the following single quote unescaped and terminating the PHP string literal.

Once the string is closed, the remainder of the attacker input is written verbatim into the configuration file as PHP code. When the file is later included by MyBB, the injected code executes with the privileges of the web server process.

Root Cause

The root cause is incomplete character set specification in the escaping routine. addcslashes($config['encoding'], "'") escapes single quotes but leaves backslashes unescaped, permitting attackers to construct a payload that breaks out of the generated PHP string literal.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends crafted values for the database encoding field to the installer at install/index.php while the installer remains available. The malicious value is written into the on-disk configuration file, and subsequent execution of that file triggers the injected PHP.

php

// Security patch in install/index.php - Fix Installer database configuration RCE (CVE-2026-45117)
// Decide if we can use a database encoding or not
if($db->fetch_db_charsets() != false)
{
-	$db_encoding = "\$config['database']['encoding'] = '".addcslashes($config['encoding'], "'")."';";
+	$db_encoding = "\$config['database']['encoding'] = '".addcslashes($config['encoding'], "\\'")."';";
}
else
{
-	$db_encoding = "// \$config['database']['encoding'] = '".addcslashes($config['encoding'], "'")."';";
+	$db_encoding = "// \$config['database']['encoding'] = '".addcslashes($config['encoding'], "\\'")."';";
}

// Write the configuration file

Source: MyBB GitHub Commit 0fe713e. The patch adds the backslash to the $characters argument so both backslashes and single quotes are escaped.

Detection Methods for CVE-2026-45117

Indicators of Compromise

HTTP POST requests to install/index.php containing backslash and single-quote sequences in the database encoding parameter
Modifications to inc/config.php outside of expected administrative maintenance windows
Unexpected PHP functions, eval() calls, or system command invocations present in inc/config.php
Web server processes spawning shells, php subprocesses, or outbound network connections shortly after installer access

Detection Strategies

Inspect inc/config.php for syntactically unusual content in the $config['database']['encoding'] assignment, including embedded quotes, semicolons, or PHP tags
Compare deployed MyBB versions against the fixed release 1.8.40 using file hashes or the reported version string
Alert on any HTTP access to install/ on production forums where installation should already be complete

Monitoring Recommendations

Enable web server access logging for the install/ path and forward events to a centralized logging or SIEM platform
Monitor the MyBB application directory for file integrity changes, especially to inc/config.php
Track process creation from the web server user, flagging shells or scripting interpreters as anomalous

How to Mitigate CVE-2026-45117

Immediate Actions Required

Upgrade MyBB to version 1.8.40, which contains the corrected addcslashes() invocation
Delete or rename the install/ directory on all production forums to eliminate installer reachability
Audit inc/config.php on any host that ran a vulnerable installer version and rebuild the file from a known-good template if tampering is suspected

Patch Information

The fix is available in MyBB 1.8.40. See the MyBB 1.8.40 release notes, the GitHub Security Advisory GHSA-gpc4-77rp-3xqr, and the MyBB version documentation for full details. The patch commit (0fe713e) updates the $characters argument of addcslashes() to include the backslash character.

Workarounds

Restrict access to install/index.php at the web server or reverse proxy layer to trusted administrator IP addresses only
Remove the install/ directory immediately after any initial setup or upgrade procedure completes
Apply web application firewall rules that block requests to the installer containing backslash-quote sequences in configuration fields

bash

# Configuration example: block installer access via Apache
<Location "/install/">
    Require ip 203.0.113.10
</Location>

# Or remove the installer directory entirely after upgrade
rm -rf /var/www/mybb/install/