CVE-2019-12831: Mybb

High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days.

In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme import stylesheet name RCE.

Affected products

• Mybb Mybb: before 1.8.21 (fixed in 1.8.21)

Published 2019-06-15. Last modified 2026-06-17.