CVE-2026-45115 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames through htmlspecialchars_uni(), which may leave single quotes unescaped. The payload is triggered when a victim chooses Yes in Please Confirm while removing the username in usercp.php, or selects the username through the onclick handler in the xmlhttp.php Select Buddies popup. The uniquely identifying implementation details include Private Messages Select Buddies list, and unescaped single quotes. This issue is fixed in version 1.8.40.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
MyBB is a widely deployed free and open-source forum software that facilitates community interactions through threaded discussions, private messaging, and user management features. A significant security vulnerability was identified within the Buddy and Ignore components of MyBB versions prior to 1.8.40. This flaw stems from insufficient input sanitization when handling usernames in specific administrative and user-facing operations. The core technical issue lies in the implementation of the htmlspecialchars_uni() function, which is intended to escape special characters for safe HTML output. However, this function fails to properly escape single quotes under certain conditions, leaving them unescaped within the generated HTML context. This oversight creates a pathway for Cross-Site Scripting attacks, specifically allowing attackers to inject malicious JavaScript code into pages viewed by other users or administrators.
The vulnerability manifests in two primary operational contexts within the MyBB interface. First, when an administrator or user attempts to remove a username from their Buddy list via the User Control Panel located at usercp.php, they are presented with a confirmation dialog asking them to confirm the action. If the targeted username contains specially crafted characters that exploit the unescaped single quote issue, the resulting HTML structure can be manipulated. When the victim clicks Yes to confirm the removal, the malformed JavaScript embedded in the username payload is executed within the context of the user's session. Second, a similar vector exists in the Private Messages module where users select buddies from a popup list generated by xmlhttp.php. The onclick handler associated with selecting a buddy processes the username data directly into event attributes or script blocks without adequate sanitization, allowing the injection to trigger upon selection rather than confirmation.
From an impact perspective, this vulnerability enables Stored Cross-Site Scripting if the malicious usernames are saved in the database and subsequently rendered on pages accessed by other users. An attacker can craft a username that includes JavaScript code designed to steal session cookies, perform actions on behalf of the victim such as posting messages or changing settings, or redirect the user to phishing sites. Since the attack vectors involve both administrative interfaces (User CP) and standard communication features (Private Messages), the potential for exploitation is broad. The attacker does not necessarily need high privileges if they can trick an administrator into removing a crafted buddy entry, nor do they need special access to exploit the Private Message selection feature, which may be accessible to regular users depending on forum configuration.
This vulnerability aligns with CWE-79, known as Improper Neutralization of Input During Web Page Generation commonly referred to as Cross-site Scripting. The specific mechanism involves insufficient escaping of single quotes within HTML attributes or script contexts, leading to code injection. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques under Taint Analysis and Injection categories, specifically leveraging client-side execution through stored payloads. It represents a classic example where input validation is attempted but implemented incorrectly due to reliance on functions that do not cover all necessary character escapes for every context in which the data might be rendered.
The resolution for this issue was released in MyBB version 1.8.40, which corrects the sanitization logic to ensure that single quotes and other special characters are properly escaped regardless of the HTML context they appear in. Administrators running versions prior to 1.8.40 should upgrade immediately to mitigate the risk of unauthorized script execution. Additionally, until an upgrade is performed, administrators can implement web application firewall rules to detect and block requests containing suspicious patterns associated with JavaScript injection attempts within username fields. Regular auditing of user-generated content for anomalous characters may also serve as a temporary mitigation strategy while patching infrastructure remains pending.