CVE-2011-10018 is a critical (CVSS 9.8) backdoor in MyBB 1.6.4 release files. The record says a crafted collapsed cookie lets an unauthenticated remote user run PHP code on the web server. MyBB told users to replace index.php with the file from the latest release and remove the install folder.
What's affected
MyBB version 1.6.4 only, according to the record and the project's own blog post. VulnCheck lists the affected range as MyBB 1.6.4 prior to rollback. The MyBB team wrote that the 1.6.4 release files were contaminated by code that was not meant to be there, and that only those running 1.6.4 are affected.
The record says the backdoor was introduced during packaging and was not part of the intended application logic. In other words, the source repository was not the weak point. The release files were.
If you run any other MyBB version, this CVE does not describe your install. Still, it is worth confirming which version you actually run, since forums often sit untouched for years.
It helps to think about where an affected copy might hide. Forum software is often installed once, then upgraded by overwriting files over FTP, which leaves old files behind. A site that was on 1.6.4 for a short time and later upgraded may still hold a modified file if the upgrade did not replace it. If your forum history includes 1.6.4 at any point, compare the root files against a clean copy of your current release, not only against the one you started with.
Hosting panels that offer one click installs are another source. Those installers may keep their own cached copies of release archives, so ask your host which build they deployed if you did not install it yourself.
How to check if you're exposed
Find the MyBB version in the admin control panel, or in the version constant in the forum's source files. If it says 1.6.4, you are in scope.
The MyBB advisory describes where to look. The forum's root index.php was one affected area, and the install folder was the other thing to remove. Compare your root index.php with the one in the Upload folder of a fresh download of the current MyBB release. Any difference you cannot explain is a reason to investigate.
diff -u /path/to/fresh/Upload/index.php /var/www/forum/index.php
Also check whether the install folder still exists on the server. MyBB's notice says to remove it. Finally, review web server logs for unusual cookie values and unexpected PHP behavior around the time you ran 1.6.4.
If the forum has been compromised, look for traces beyond the two files MyBB names. List recently modified PHP files in the web root and the uploads folder:
find /var/www/forum -name "*.php" -mtime -30 -ls
Adjust the age to match the period you want to cover. Any file you cannot explain should be compared with a clean copy of MyBB or removed after you have saved a copy for analysis.
What to do now
- Confirm the MyBB version. If it is 1.6.4, treat the server as potentially compromised.
- Upgrade to the latest MyBB release as the project advises, and replace the root index.php with the one from the clean download.
- Delete the install folder, as the MyBB announcement instructs.
- Look for other changed or unknown files. A backdoor that gave PHP execution may have been used to add more.
- Rotate the database password, admin passwords and any API keys stored in the forum configuration.
- Add file integrity monitoring to the web root so unexpected changes raise an alert.
Why it matters
The record lists two weaknesses: CWE-912 (Hidden Functionality) and CWE-94 (Code Injection). The first describes how the code got there: functionality that is not documented and that the owner did not intend. The second describes what it does: it takes attacker-supplied data from a cookie and runs it as PHP.
Packaging-stage compromises like this one are hard to see from a code review of the repository. That is why verifying release artifacts matters. Compare checksums, diff what you deployed against what you downloaded, and keep a record of the exact build running in production. The record does not mark this CVE as CISA KEV and does not claim exploitation in the wild, though public exploit material is listed among its references.
A forum is also a good example of a system that gets installed once and forgotten. A short inventory of installed web applications and their versions closes most of that gap.
Try it yourself
This demo shows how an inventory of components and versions lets you answer the question of whether you run the affected release in minutes instead of days.
Click through it at your own pace, or open it full screen.
Quick check
Is MyBB 1.6.5 or later affected?
The record and the MyBB post scope the problem to 1.6.4 release files. Check the MyBB advisory for the latest guidance on your version.
Is removing the install folder enough?
No. MyBB also told users to replace index.php with the clean copy. If the server ran 1.6.4, also look for other changes and rotate secrets.
Sources
Last reviewed: 19 October 2026.
