CVE-2026-45125
MEDIUM
5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: none
Description
AI Translation Available
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40.
93
Improper Neutralization of CRLF Sequences ('CRLF Injection')
DraftCommon Consequences
Security Scopes Affected:
Integrity
Potential Impacts:
Modify Application Data
Applicable Platforms
All platforms may be affected
https://github.com/mybb/mybb/commit/5046c56b515d4593297a4f65b0c6ccb0b55baa01
https://github.com/mybb/mybb/releases/tag/mybb_1840
https://github.com/mybb/mybb/security/advisories/GHSA-f626-53q9-pqm9
https://mybb.com/versions/1.8.40