MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attackers can modify upload path settings, upload a malicious PHP-embedded image file, and execute commands through the language configuration editing interface.
References
| Link | Resource |
|---|---|
| https://fdlucifer.github.io/2023/01/17/mybb1-8-32-LFI-RCE/ | Exploit Third Party Advisory |
| https://mybb.com/ | Product |
| https://www.exploit-db.com/exploits/51213 | Exploit |
| https://www.vulncheck.com/advisories/mybb-authenticated-remote-code-execution-via-chained-vulnerabilities | Exploit Third Party Advisory |
| https://www.cve.org/CVERecord?id=CVE-2022-45867 |
Configurations
History
27 Dec 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | () https://www.vulncheck.com/advisories/mybb-authenticated-remote-code-execution-via-chained-vulnerabilities - Exploit, Third Party Advisory |
26 Dec 2025, 16:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://fdlucifer.github.io/2023/01/17/mybb1-8-32-LFI-RCE/ - Exploit, Third Party Advisory | |
| References | () https://mybb.com/ - Product | |
| References | () https://www.exploit-db.com/exploits/51213 - Exploit | |
| References | () https://www.vulncheck.com/advisories/mybb-authenticated-remote-code-execution-via-chained-vulnerabilities - Third Party Advisory, Exploit | |
| CPE | cpe:2.3:a:mybb:mybb:1.8.32:*:*:*:*:*:*:* | |
| First Time |
Mybb
Mybb mybb |
22 Dec 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-22 22:16
Updated : 2025-12-27 19:15
NVD link : CVE-2023-53979
Mitre link : CVE-2023-53979
CVE.ORG link : CVE-2023-53979
JSON object : View
Products Affected
mybb
- mybb
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')