CVE-2022-39265

    Dashboard / Vulnerabilities / CVE-2022-39265

    CVE-2022-39265

    Published: 6 Oct 2022Last Modified: 12 Aug 2026

    Summary: Mail settings' command parameter injection in mybb

    Details: MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://github.com/mybb/mybb/blob/mybb_1830/install/resources/settings.xml#L2331-L2338, https://mybb.com/versions/1.8.31/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39265.json, https://github.com/mybb/mybb/security/advisories/GHSA-hxhm-rq9f-7xj7, https://nvd.nist.gov/vuln/detail/CVE-2022-39265, https://github.com/mybb/mybb/commit/0cd318136a10b029bb5c8a8f6dddf39d87519797

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0cd318136a10b029bb5c8a8f6dddf39d87519797

    Affected versions

    mybb_1831_build

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39265 | CVE-DB