Download MyBB 1.8.22

MyBB is a PHP-developed bulletin board system program. It originated in 2002 as a fork of EXtreme Message Board (XMB) and was initially closed source. However, since version 1.4.2 it is released as open source. Version 1.8 was released five years ago and an update has just been released with version 1.8.22. Further work will follow on version 2.0 steadily. The changelog for this release looks like this:

MyBB 1.8.22 Released — Security & Maintenance Release

Note: this version removes the discontinued Yahoo profile field, which may have been customized for other purposes.

5 security vulnerabilities addressed:

• High risk: Installer RCE on settings file write — reported by yelang123 of Stealien
• Medium risk: Arbitrary upload paths & Local File Inclusion RCE — reported by CNCERT
• Medium risk: XSS via insufficient HTML sanitization of Blog feed & Extend data — reported by Devilshakerz or MyBB Team
• Low risk: Open redirect on login — reported by Jyoti Raval
• Low risk: SCEditor reflected XSS — reported by Cillian Collins, bl4ckh4ck5

Check all 36 issues resolved. check Release Notes for a list of changes to language files, templates and unresolved issues.