Researcher DisclosureTechnical description
https://fdlucifer.github.io/2023/01/17/mybb1-8-32-LFI-RCE CVE-2023-53979
HIGH
MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities
Record summary
CVE-2023-53979 has a selected CVSS score of 8.6 (high); EIP currently links 1 catalogued exploit.
Description
MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attackers can modify upload path settings, upload a malicious PHP-embedded image file, and execute commands through the language configuration editing interface.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 22, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | MyBB 1.8.32 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBMyBB 1.8.32 - Remote Code Execution (RCE) (Authenticated)ExploitDB exploitby lUc1f3r11Not analyzed1 file
References
6Official MyBB Vendor Homepageproduct
https://mybb.com/ nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-53979 cve.org
https://www.cve.org/CVERecord?id=CVE-2022-45867 ExploitDB-51213exploit
https://www.exploit-db.com/exploits/51213 VulnCheck Advisory: MyBB 1.8.32 Authenticated Remote Code Execution via Chained VulnerabilitiesThird-party advisory
https://www.vulncheck.com/advisories/mybb-authenticated-remote-code-execution-via-chained-vulnerabilities