A flaw in MyBB’s installer module allows crafted database configuration values to be written to the server’s configuration file without proper escaping. The addcslashes() function used by install/index.php does not escape backslashes in MyBB versions 1.8.13 through 1.8.40, enabling attackers to inject PHP code that is subsequently executed. This weakness is classified as CWE‑94, which signifies an untrusted input leading to code injection. The consequence is that an adversary who can access the installer can run arbitrary PHP commands, potentially taking complete control of the web server.

The vulnerability affects MyBB forum software products released from version 1.8.13 to 1.8.40 inclusive. Any installation using those versions with the installer module enabled is susceptible. The defect was resolved in MyBB 1.8.40 and later releases.

With a CVSS score of 9.8, the flaw represents a critical severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of a mitigated solution makes exploitation likely if the installer remains exposed. The attack path is straightforward: an attacker submits a malicious payload through the installer’s database configuration form, causing PHP injection when the installer writes the configuration file. Successful exploitation grants the attacker remote code execution on the host system.