MyBB 1.8.38 is now available, and is a security & maintenance release.

Administrators of installed boards should update the existing configuration (inc/config.php) to include all addresses blocked by default in Disallowed Remote Addresses.

• 2 security vulnerabilities addressed:
  • Low risk: Incomplete disallowed remote addresses list SSRF (advisory) — reported by shin24
  • Low risk: Backups directory .htaccess deletion (advisory) — reported by shin24
• 16 issues resolved

Check the Release Notes for more information.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team