MyBB 1.8.32 Language Configuration Editing Interface path traversal

Summaryinfo

A vulnerability categorized as critical has been discovered in MyBB 1.8.32. This impacts an unknown function of the component Language Configuration Editing Interface. Executing a manipulation can lead to path traversal. This vulnerability is handled as CVE-2023-53979. The attack can be executed remotely. Additionally, an exploit exists.

Detailsinfo

A vulnerability was found in MyBB 1.8.32. It has been declared as critical. This vulnerability affects an unknown functionality of the component Language Configuration Editing Interface. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attackers can modify upload path settings, upload a malicious PHP-embedded image file, and execute commands through the language configuration editing interface.

The weakness was released by lUc1f3r11 as 51213. The advisory is available at exploit-db.com. This vulnerability was named CVE-2023-53979 since 12/20/2025. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are unknown but a public exploit is available. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (51213) and EUVD (EUVD-2023-60241). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Name

• MyBB

Version

• 1.8.32

License

• open-source

Website

• Product: https://mybb.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion