vBulletin has patched CVE-2026-61511, a critical remote code execution flaw that could let unauthenticated attackers execute arbitrary PHP code and compromise vulnerable forum servers. This issue affects vBulletin versions 6.2.1 and earlier as well as versions 6.1.6 and earlier.
The flaw exists in the file /includes/vb5/template/runtime.php, specifically within the vB5_Template_Runtime::runMaths() method. This function processes values used by vBulletin’s {vb:math} template tag.
The vulnerable code attempts to restrict input with a regular expression before passing the result to PHP’s eval() function. However, the filtering is inadequate, allowing characters such as digits, parentheses, arithmetic operators, binary operators, and the XOR operator.
Since the application evaluates the resulting string as PHP code, attackers may leverage methods known as “PHPFuck” techniques to construct function names and commands without directly using blocked alphabetic characters.
vBulletin Vulnerability
Researchers noted that exploiting this vulnerability does not require administrator access. An attacker can exploit the ajax/render/[template] route to render a template containing a {vb:math} tag with attacker-controlled data.
For example, the pagenav template assigns the pagenav[pagenumber] request parameter to a template variable, which is later used in a mathematical expression that reaches the vulnerable runMaths() function.
As a result, a specially crafted request may lead the server to evaluate attacker-controlled PHP expressions. Successful exploitation could enable attackers to execute operating-system commands under the permissions of the web server process.
This level of access could result in data theft, website defacement, malware deployment, credential harvesting, or lateral movement within the hosting environment. Public-facing vBulletin forums should be prioritized for patching since exploitation can occur without authentication.
Independent researchers working with SSD Secure Disclosure reported the vulnerability, which vBulletin fixed in version 6.2.2 and patched in earlier supported releases.
Administrators should immediately update to vBulletin version 6.2.2 or apply the vendor-provided patches for affected versions 6.2.1, 6.2.0, and 6.1.6.
Organizations should also monitor web-server logs for unusual requests related to ajax/render/pagenav, routestring, or unexpected pagenav[pagenumber] values.
Security teams are advised to investigate signs of compromise, including newly created PHP files, unexpected outbound connections, suspicious web-server child processes, altered templates, and unauthorized administrator accounts.
