CVE-2026-61511

Name of the Vulnerable Software and Affected Versions vBulletin versions 5.x through 5.7.5 vBulletin versions 6.x through 6.2.1

Description An eval injection issue exists in the vB5 Template Runtime::runMaths() method within the template runtime. This occurs because the method processes expressions from the {vb:math} template tag and passes them to the PHP eval() function. Although a regular expression filter is used to restrict input to mathematical symbols, it is insufficiently restrictive. An unauthenticated remote attacker can bypass this filter using phpfuck-style encoding—a technique of constructing executable code using only permitted characters—to execute arbitrary PHP code on the server.

This can be exploited via the unauthenticated ajax/render template route, specifically the ajax/render/pagenav endpoint, by supplying crafted input through the pagenav[pagenumber] parameter.

Recommendations Update vBulletin to version 6.2.2 or newer. Apply the official vendor patches for versions 6.2.1, 6.2.0, and 6.1.6. For versions 5.x and other unsupported branches, migrate to a supported and patched version. As a temporary mitigation, use a Web Application Firewall (WAF) to block anomalous requests to the ajax/render/pagenav endpoint and restrict suspicious values in the pagenav[pagenumber] parameter.