UpHeron
All vulnerabilities

Servers and applications

CVE-2021-43281

ACP Settings management RCE

Severity
High 7.2
Published
30 Oct 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.8.29
Also known as
GHSA-8gxx-vmr9-h39p
Sources
NVD, Project advisories (GitHub)

Description

MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.

Affected software

SoftwareAffected versions
MyBBServers and applications · cpe:a:mybb:mybb
  • From 1.2.0 before 1.8.29
MyBBServers and applications · github:mybb/mybb
  • From 1.2.0 before 1.8.29

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-43281
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-43281
  • GitHub Advisory Database https://github.com/advisories/GHSA-8gxx-vmr9-h39p
  • github.com https://github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39p