Security Advisory

CVE-2026-45123

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-18 15:44:26

Last updated 2026-08-18 18:55:56

Assigner GitHub_M

CVSS score 4.3

State PUBLISHED

Description

MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40.

← Browse all CVEs View on cve.org ↗