by Kastro
Paper/Archive/CVE-2026-61511

CVE-2026-61511

vBulletin vBulletin — vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

EPSS 6%public exploitCVSS 9.8
critical.is priorityof 100
58
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 92.9.929 × 2018.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.

Affected

ProductAffectedFixed inSource
vBulletin5.0.0 – 5.7.5–CNA
vBulletin6.0.0 – 6.2.16.2.2CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitkarmainsecurity.com/KIS-2026-13exploitssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rcerefforum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6refforum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509404-vbulletin-6-2-2-is-availablewriteupvulncheck.com/advisories/vbulletin-eval-injection-rce-via-vb5-template-runtime-phprefseclists.org/fulldisclosure/2026/Aug/29