Skip to content
eastbaycyber

CVE-2026-61511: Unauthenticated vBulletin eval injection RCE

CVE explainers 10 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-07-27
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - Critical unauthenticated RCE in vBulletin template processing. - Affects vBulletin 5.x through 5.7.5 and 6.x through 6.2.1. - Upgrade 6.x to 6.2.2 immediately; treat exposed forums as high priority.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-61511
CVSS 9.8 Critical
Attack vector Network
Privileges required None
Patch available Yes for 6.x, confirmed/strongly indicated via 6.2.2; 5.x patch target not confirmed from available primary sources

CVE-2026-61511 is a critical remote code execution issue in vBulletin caused by unsafe use of eval() inside template runtime logic. The issue is especially severe because public technical analysis describes an unauthenticated exploitation path through the ajax/render route using attacker-controlled input in pagenav[pagenumber].

From an operational perspective, this should be treated as an internet-facing application emergency. The combination of no authentication requirement, remote reachability, and a code execution outcome means exposed instances are high-value targets even if widespread in-the-wild exploitation has not yet been confirmed. Where exact patch guidance for older 5.x builds is unclear, defenders should assume those versions remain unsafe until vendor-confirmed remediation is applied.

What Is This Vulnerability?

The root cause is an eval injection flaw in the vBulletin template runtime. According to public technical write-ups and the NVD description, the vulnerable code is in vB5_Template_Runtime::runMaths() in /includes/vb5/template/runtime.php. The function attempts to validate mathematical input using a restrictive regular expression and then passes the resulting expression into eval().

That pattern is inherently dangerous. Even when a regex appears to limit input to arithmetic operators and related characters, it is still unsafe if the resulting string is executed. In this case, the input validation is not restrictive enough to prevent attacker-controlled expressions from being transformed into executable PHP. Researchers reported that phpfuck-style encoding can be built using characters allowed by the filter, bypassing the intended protection and reaching arbitrary code execution.

The practical exploitation path matters more than the bug class name. Public disclosure indicates attackers can reach this vulnerable logic through the unauthenticated ajax/render/[template] route, abusing templates that feed user-supplied data into {vb:math} processing. The default pagenav template was specifically identified as a viable path, with malicious input supplied via pagenav[pagenumber].

In short: this is not just a theoretical unsafe coding pattern buried in backend logic. It is a remotely reachable, internet-exposed path to PHP code execution in a widely deployed forum platform.

Technical Notes

// Conceptual vulnerable pattern described in public analysis
if (preg_match($filter, $expression)) {
    eval('$result = ' . $expression . ';');
}

Vulnerable component:
- File: /includes/vb5/template/runtime.php
- Method: vB5_Template_Runtime::runMaths()
- User-controlled parameter: pagenav[pagenumber]
- Reachable route: ajax/render/[template]
AnalystImpact · assess the risk

Who Is Affected?

According to the NVD record, the affected version ranges are:

  • vBulletin 5.x through 5.7.5
  • vBulletin 6.x through 6.2.1

Those ranges should be treated as the authoritative affected scope based on the available source material. The technical write-up aligns with that understanding, describing the issue as affecting 5.7.5 and earlier in the 5.x train, and 6.2.1 and earlier in the 6.x train. For defenders doing asset inventory, any self-hosted vBulletin deployment matching those ranges should be considered vulnerable until proven otherwise.

The remediation picture is clearer for 6.x than for 5.x. Available official announcement titles and the subsequent release note strongly indicate that vBulletin 6.2.2 contains the fix for the 6.x branch. For 5.x, however, the exact fixed version number could not be retrieved directly from official content because the relevant vendor forum pages returned HTTP 403 to source collection. That does not mean 5.x is safe; it means defenders should assume 5.x through 5.7.5 is vulnerable and verify patch availability directly with the vendor before delaying action.

Organizations most at risk are those exposing vBulletin directly to the internet, especially forums handling user registration, anonymous browsing, or public content rendering. Managed hosting environments, shared web stacks, and instances with weak monitoring are likely to face elevated incident response complexity if exploitation occurs.

Technical Notes

# Example inventory checks on Linux hosts
find /var/www -type f \( -name "config.php" -o -name "init.php" \) 2>/dev/null | grep -i vbulletin

# If package or deployment metadata is available, record the installed version
grep -R "vBulletin" /var/www 2>/dev/null | head

Treat as affected if you confirm:
- vBulletin 5.x and version <= 5.7.5
- vBulletin 6.x and version <= 6.2.1

CVSS Score Breakdown

The published base severity is CVSS 9.8 Critical. While the full vector string was not provided in the returned NVD output available for this task, the score strongly aligns with a typical unauthenticated network-reachable remote code execution scenario. That implies a high-impact issue affecting confidentiality, integrity, and availability, with very low barriers to exploitation.

For defenders, the key score components are easy to map to operational risk. The attack is described as network-accessible, so no local foothold is needed. Privileges required are none, because exploitation can occur through an unauthenticated route. User interaction appears unnecessary, since the attack path involves direct requests to the application. The resulting impact is effectively complete compromise of the web application context, and often more depending on the PHP runtime permissions and server hardening.

This is why a 9.8 matters beyond the label. On a public forum server, code execution can lead to web shell deployment, credential theft, database access, session compromise, spam infrastructure abuse, and lateral movement into adjacent systems. Even if your deployment is segmented, a vulnerable internet-facing PHP application should be assumed to be a practical initial access target.

Because the exact vector string was not included in the available NVD output, defenders should avoid over-quoting unknown submetrics. In the absence of the official vector string, the safe working assumption is the highest-risk common case: remote, unauthenticated exploitation with severe downstream impact.

Exploitation Status

Public technical disclosure exists, and the exploitation method is sufficiently detailed to be operationally useful to attackers. The NVD description itself outlines the vulnerable method, the unsafe filtering behavior, and the unauthenticated attack path through ajax/render with pagenav[pagenumber]. The Karma(In)Security and other referenced disclosures provide additional implementation detail that can function as an exploitation blueprint even without a polished exploit repository.

At the same time, active exploitation in the wild is not confirmed in the sources used here. This CVE is not currently listed in CISA KEV, and no CISA-confirmed exploitation evidence was available in the provided research note. A specific GitHub proof-of-concept repository was also not confirmed from the returned search results. That means the most defensible status statement is:

  • Public technical disclosure: yes
  • Exploit methodology publicly described: yes
  • Specific public GitHub PoC confirmed: no, not from available sources
  • Exploitation in the wild confirmed: no, not from available sources
  • CISA KEV listing: no

Defenders should not take the lack of KEV inclusion as comfort. For an unauthenticated RCE in a common web application, public exploit details alone are enough to create immediate risk. Once a route, parameter, and primitive are disclosed, weaponization timelines are often short.

ResponderRunbook · act now

How to Detect It

Start by reviewing HTTP access logs and WAF telemetry for requests targeting template rendering endpoints, especially ajax/render. Give priority to requests containing the pagenav[pagenumber] parameter, unusual arithmetic-like payloads, or high-entropy strings made entirely from characters that might satisfy a restrictive regex filter. Because public analysis specifically names pagenav[pagenumber] as the user-controlled input, this parameter should be central to triage.

Detection should also extend beyond the inbound request. If exploitation succeeds, you may see downstream indicators in PHP-FPM logs, web server error logs, process creation telemetry from the web server user, suspicious file writes in the web root, and follow-on outbound connections. Since this bug can yield arbitrary PHP execution, defenders should assume attacker activity may quickly transition from a crafted HTTP request to filesystem persistence or command execution.

Technical Notes

/ajax/render

pagenav(\[|\%5B)pagenumber(\]|\%5D)=

# Quick Apache/Nginx log triage for suspected exploit path
grep -RIE 'ajax/render|pagenav(\[|%5B)pagenumber(\]|%5D)=' /var/log/nginx /var/log/apache2 2>/dev/null

index=web_logs ("ajax/render" AND ("pagenav[pagenumber]" OR "pagenav%5Bpagenumber%5D"))
| stats count by src_ip, http_method, uri, user_agent, status

# Example Sigma-style idea for reverse proxy or WAF logs
title: Suspicious vBulletin ajax/render access with pagenav parameter
logsource:
  category: webserver
detection:
  selection1:
    cs-uri-query|contains:
      - "pagenav[pagenumber]="
      - "pagenav%5Bpagenumber%5D="
  selection2:
    cs-uri-stem|contains: "/ajax/render"
  condition: selection1 and selection2
level: high

Also inspect for post-exploitation artifacts:

# Hunt for recently modified PHP files under the web root
find /var/www -type f -name "*.php" -mtime -7 -ls 2>/dev/null

# Look for suspicious child processes from web server contexts
ps auxf | egrep 'php-fpm|apache2|nginx|sh|bash|curl|wget'

If you have no reliable logging, assume attempted exploitation cannot be ruled out and proceed with containment-focused remediation.

Mitigation and Patching

For vBulletin 6.x, the available evidence strongly indicates that the issue is fixed in vBulletin 6.2.2. If you are running 6.x through 6.2.1, upgrade to 6.2.2 as the primary remediation path. Because the flaw is pre-authentication and internet-reachable, patching should be prioritized over slower change windows where possible.

For vBulletin 5.x through 5.7.5, the affected range is clear, but the exact fixed 5.x version was not confirmed from the available primary sources due to vendor forum retrieval limits. In that situation, defenders should not guess. Instead, assume 5.x remains exposed, contact the vendor or access official customer advisories directly, and apply the vendor-released security update for your branch as soon as it is verified. If no supported patch path exists for your 5.x deployment, risk treatment should shift toward temporary exposure reduction or accelerated platform upgrade.

If immediate patching is not possible, apply compensating controls. Restrict access to the forum admin and rendering endpoints where feasible, place the application behind a WAF, tighten egress from the web tier, and monitor aggressively for access to ajax/render containing pagenav[pagenumber]. Temporary blocking is not equivalent to a fix, especially when attackers can vary payload formats, but it can reduce opportunistic exploitation while maintenance is scheduled.

Technical Notes

# Before upgrading, back up the current web root and database
tar czf /root/vbulletin-backup-$(date +%F).tar.gz /var/www/html/vbulletin

# Example MySQL/MariaDB backup
mysqldump -u root -p --databases vbulletin > /root/vbulletin-$(date +%F).sql

# Example upgrade workflow placeholder for 6.x
# Use the vendor-provided upgrade package for 6.2.2 and follow official instructions.
# Exact commands vary by deployment method.
unzip vbulletin-6.2.2.zip -d /tmp/vbulletin-6.2.2
rsync -av /tmp/vbulletin-6.2.2/upload/ /var/www/html/vbulletin/

# Temporary mitigation example: restrict direct access to ajax/render
location ~* ^/ajax/render {
    allow 192.0.2.0/24;
    deny all;
}

# Temporary mitigation example for Apache
<Location "/ajax/render">
    Require ip 192.0.2.0/24
</Location>

# If you cannot safely restrict by IP, consider WAF rules to flag/block requests
# containing the known parameter until patching is complete.
grep -RIE 'ajax/render|pagenav(\[|%5B)pagenumber' /var/log/nginx /var/log/apache2 2>/dev/null

Important caveat: endpoint blocking and parameter filtering may break legitimate functionality and may not stop determined attackers if alternate render paths exist. The durable fix is vendor remediation, with 6.2.2 being the clear target for the 6.x train based on the evidence available here.

References

The primary public description comes from the NVD entry for CVE-2026-61511, which states that vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection issue in vB5_Template_Runtime::runMaths() and that unauthenticated attackers can exploit it via crafted input in pagenav[pagenumber] through the ajax/render route.

Additional technical context is available from third-party disclosures referenced by NVD, including a Karma(In)Security write-up describing the vulnerable file and method, the insufficient regex filter, the eval() sink, and the exploitation path through {vb:math} processing. Vendor announcement titles indicate a security patch covering 6.2.1, 6.2.0, and 6.1.6, followed by availability of vBulletin 6.2.2, but the official forum pages were not directly retrievable in the research context due to HTTP 403 responses.

For further reading on security vulnerabilities, you can check out our articles on what is vulnerability assessment and what is bootkit.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-07-27

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.