UpHeron
All vulnerabilities

Servers and applications

CVE-2022-39265

Mail settings' command parameter injection

Severity
High 7.2
Published
4 Oct 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.8.31
Also known as
GHSA-hxhm-rq9f-7xj7
Sources
NVD, Project advisories (GitHub)

Description

MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may…

Affected software

SoftwareAffected versions
MyBBServers and applications · cpe:a:mybb:mybb
  • Every version before 1.8.31
MyBBServers and applications · github:mybb/mybb
  • Every version before 1.8.31

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-39265
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-39265
  • GitHub Advisory Database https://github.com/advisories/GHSA-hxhm-rq9f-7xj7
  • github.com https://github.com/mybb/mybb/security/advisories/GHSA-hxhm-rq9f-7xj7