PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9414 Mybb CVE debrief

CVE-2016-9414 is a high-severity information disclosure issue in MyBB and MyBB Merge System before 1.8.7. The NVD record says remote attackers could obtain sensitive information by taking advantage of missing directory listing protection in upload directories. The CVE was published on 2017-01-31 and later modified on 2026-05-13.

Vendor
Mybb
Product
CVE-2016-9414
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators and operators of MyBB or MyBB Merge System deployments, especially internet-facing forums and sites that expose upload directories.

Technical summary

NVD maps this issue to CWE-200 and rates it CVSS 3.0 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The affected product versions are MyBB and MyBB Merge System through 1.8.6. In practical terms, upload paths without directory listing protection may reveal sensitive information that should not be publicly browsable.

Defensive priority

High. This is a network-reachable, unauthenticated confidentiality issue with high impact on sensitive data exposure.

Recommended defensive actions

  • Upgrade MyBB and MyBB Merge System to 1.8.7 or later.
  • Verify that upload directories do not allow directory listing or directory indexing.
  • Review web server and application configuration so uploaded content is only exposed when intended.
  • Check whether any sensitive files were placed in web-accessible upload locations and remove or restrict them as needed.

Evidence notes

This debrief is based on the NVD CVE record, which lists vulnerable CPE criteria for MyBB and MyBB Merge System up to 1.8.6, a CVSS 3.0 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and CWE-200 as the primary weakness. The record references a vendor advisory and related mailing-list posts, including the MyBB 1.8.7 / Merge System 1.8.7 release announcement. No exploit code or weaponized reproduction steps are included.

Official resources

Publicly disclosed in the CVE/NVD record published on 2017-01-31; the supplied record was last modified on 2026-05-13. The source references in the record include vendor and mailing-list materials from 2016. No Known Exploited Vulnerability