MyBB 1.8.22 is now available, and is a security & maintenance release.

Note: this version removes the discontinued Yahoo profile field, which may have been customized for other purposes.

• 5 security vulnerabilities addressed:
  • High risk: Installer RCE on settings file write — reported by yelang123 of Stealien
  • Medium risk: Arbitrary upload paths & Local File Inclusion RCE — reported by CNCERT
  • Medium risk: XSS via insufficient HTML sanitization of Blog feed & Extend data — reported by Devilshakerz of MyBB Team
  • Low risk: Open redirect on login — reported by Jyoti Raval of Qualys
  • Low risk: SCEditor reflected XSS — reported by Cillian Collins, bl4ckh4ck5
• 36 issues resolved

Check Release Notes for a list of changes to language files, templates and unresolved issues.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.21 is now available, and is a security & maintenance release.

This version includes updated jQuery and SCeditor, JSON Syndication format, improved PostgreSQL support, improved PHP >= 7.1 compatibility, improved search function reliability. See information on SCEditor-related theme updates.

• 6 security vulnerabilities addressed:
  • High risk: Theme import stylesheet name RCE — reported by Simon Scannell and Robin Peraglie of RIPS Technologies
  • High risk: Nested video MyCode persistent XSS — reported by Simon Scannell and Robin Peraglie of RIPS Technologies
  • Medium risk: Find Orphaned Attachments reflected XSS — reported by Simon Scannell of RIPS Technologies
  • Medium risk: Post edit reflected XSS — reported by adm1nkyj of ENKI
  • Medium risk: Private Messaging folders SQL injection — reported by Alex of DiscoveryGC
  • Low risk: Potential phar deserialization through Upload Path — reported by Simon Scannell of RIPS Technologies
• 39 issues resolved

Check Release Notes for a list of changes to language files, templates and unresolved issues.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.20 is now available, and is a security & maintenance release.

This release includes allowing users to see their unapproved content and view user referrals; compatibility with PHP >= 7.2 has been improved and jQuery has been upgraded to 3.0.0, which might affect custom JavaScript code in plugins and themes.

• 5 security vulnerabilities addressed:
  • Medium risk: Reset Password reflected XSS
  • Medium risk: ModCP Profile Editor username reflected XSS — reported by Jovan Zivanovic of MaTRIS Research Group, SBA Research
  • Low risk: Predictable CSRF token for guest users — reported by Devilshakerz of MyBB Team
  • Low risk: ACP Stylesheet Properties XSS — reported by Cillian Collins
  • Low risk: Reset Password username enumeration via email — reported by Abdullah Md. Shaleh
• 42 issues resolved

Check Release Notes for a list of changes to language files, templates and unresolved issues.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.19 is now available, and is a security & maintenance release.

This update includes improved compatibility with PostgreSQL and resolves regressions from previous versions. Administrators may need to update CSS code in global.css for customized themes.

• 4 security vulnerabilities addressed:
  • High risk: Email field SQL Injection — reported by StefanT
  • Medium risk: Video MyCode Persistent XSS in Visual Editor — reported by Numan OZDEMIR of InfinitumIT
  • Low risk: Insufficient permission check in User CP’s attachment management — reported by StefanT
  • Low risk: Insufficient email address verification — reported by StefanT
• 8 issues resolved

Check Release Notes for a list of changes to language files, templates and unresolved issues.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.18 is now available, and is a security & maintenance release.

Changes include added support for Mixer videos and multi-file attachments, modified Word Filter behavior, fixes to the mailing queue and improved compatibility with SQLite and MySQL 8. Theme CSS changes may be required and administrators may need to review Word Filters.

• 2 security vulnerabilities addressed:
  • High risk: Image MyCode “alt” attribute persistent XSS — reported by Punisher_HF
  • Medium risk: RSS Atom 1.0 item title persistent XSS — reported by 0xB9
• 30 issues resolved

Check Release Notes for a list of changes to language files, templates and unresolved issues.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.16 is now available, and is a security & maintenance release.

This update includes compatibility fixes for database engines and recent PHP versions as well as performance and global security improvements. Note that the theme’s CSS files may need to be updated. If you use the login_attempt_check() function, note that its signature has changed.

• 6 security vulnerabilities addressed:
  • High risk: Image & URL MyCode Persistent XSS — reported by Punisher_HF
  • Medium risk: Multipage Reflected XSS — reported by Dimaz Arno of Ethic Ninja
  • Low risk: ACP logs XSS — reported by Cillian Collins
  • Low risk: Arbitrary file deletion via ACP’s Settings — reported by Devilshakerz of MyBB Team
  • Low risk: Login CSRF — reported by Cillian Collins
  • Low risk: Non-video content embedding via Video MyCode — reported by Punisher_HF
• 66 issues resolved

Check Release Notes for a list of changes to language files, templates and unresolved issues.

Issues on Upgrade?

• SQL syntax error during upgrade: overwrite install/resources/upgrade43.php and run the upgrade process again
• “not allowed” reporting problem: overwrite report.php
• “Authorization code mismatch” on login: use the ACP’s Find Updated Templates feature to insert missing my_post_key input fields to login forms (more information)

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.15 is now available, and is a security & maintenance release.

This update includes compatibility improvements for PostgreSQL and recent PHP versions as well as minor optimizations.

• 10 security vulnerabilities addressed:
  • Medium risk: Tasks Local File Inclusion — reported by Riley Baird
  • Medium risk: Forum Password Check Bypass — reported by Riley Baird
  • Low risk: Admin Permissions Group Title XSS — reported by Nathaniel Suchy
  • Low risk: Attachment types file extension XSS — reported by Nathaniel Suchy
  • Low risk: Moderator Tools XSS — reported by Nathaniel Suchy
  • Low risk: Security Questions XSS — reported by doylecc
  • Low risk: Settings Management XSS — reported by Nathaniel Suchy
  • Low risk: Templates Set Name XSS — reported by Nathaniel Suchy
  • Low risk: Usergroup Promotions XSS — reported by Nathaniel Suchy
  • Low risk: Warning Types XSS — reported by Nathaniel Suchy
• 24 issues resolved

Check Release Notes for a list of changes to language files, templates and unresolved issues.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.14 is now available, and is a security & maintenance release.

This update applies security patches and fixes minor issues related to the upgrade script included in the previous version.

• 2 security vulnerabilities addressed:
  • High risk: Language file headers RCE — reported by Julian Rittweger
  • Low risk: Language Pack Properties XSS — reported by Julian Rittweger
• 2 issues resolved

Check Release Notes for a list of changes to language files, templates and unresolved issues.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.13 is now available, and is a security & maintenance release.

This update includes fixes related to compatibility with PostgreSQL, SQLite and PHP 7.2 and resolves attachment HTML output problems. Note that the theme’s CSS files may need to be updated. Please see this post on the community forum for more information.

• 7 security vulnerabilities addressed:
  • High risk: Installer RCE on configuration file write — reported by pabstersac
  • High risk: Language file headers RCE — reported by Julian Rittweger
  • Medium risk: Installer XSS — reported by pabstersac
  • Medium risk: Mod CP Edit Profile XSS — reported by Julian Rittweger
  • Low risk: Insufficient moderator permission check in delayed moderation tools — reported by Starpaul20 of MyBB Team
  • Low risk: Announcements HTML filter bypass
  • Low risk: Language Pack Properties XSS — reported by Julian Rittweger
• 62 issues resolved

Check Release Notes for a list of changes to language files, templates and unresolved issues.

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.

Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.

If you would like to contribute to the Project, Get Involved.

Thanks,

MyBB Team