PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-8977 Mybb CVE debrief

CVE-2015-8977 is an information-disclosure flaw in MyBB and MyBB Merge System where error log files can reveal the installation path to a remote attacker. NVD rates it HIGH (CVSS 3.0: 7.5) with network access, no privileges, and no user interaction, and maps it to CWE-532. The vendor release notes identify fixed releases for MyBB 1.6.18, MyBB 1.8.6, and MyBB Merge System 1.8.6.

Vendor
Mybb
Product
Merge System
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators and hosting teams running public-facing MyBB or MyBB Merge System installations, especially those still on versions older than the fixed releases or exposing error logs through the web server.

Technical summary

The NVD description states that remote attackers could obtain the installation path through vectors involving error log files. NVD classifies the weakness as CWE-532 (Insertion of Sensitive Information into Log File) and lists vulnerable ranges including MyBB up to 1.6.17, MyBB 1.8.0 through 1.8.5, and MyBB Merge System up to 1.8.5. The reference set includes vendor release notes and third-party advisories supporting the disclosure.

Defensive priority

High — externally reachable information disclosure with no authentication or user interaction required.

Recommended defensive actions

  • Upgrade MyBB to 1.6.18 or 1.8.6, and MyBB Merge System to 1.8.6 or later.
  • Verify that error log files are not web-accessible and are stored outside the document root where possible.
  • Review exposed logs for unintended path disclosure and remove or restrict any publicly reachable copies.
  • Confirm the deployment still serves only sanitized error output after the upgrade.

Evidence notes

This debrief is based on the NVD record, which describes remote path disclosure via error log files and provides the CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The supplied NVD data also lists affected versions and maps the issue to CWE-532. Vendor release notes dated 2015-09-07 identify the fixed versions (MyBB 1.6.18, MyBB 1.8.6, Merge System 1.8.6). The supplied corpus does not indicate KEV inclusion or known ransomware use.

Sources and references

Verified primary and authoritative sources

  • CVE-2015-8977 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2015-8977

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2015-8977 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2015-8977

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.