CVE-2026-75514

Name of the Vulnerable Software and Affected Versions BunkerWeb versions prior to 1.6.13

Description The blacklist, greylist, and antibot modules trust PTR suffix matches in IGNORE RDNS, GREYLIST RDNS, and ANTIBOT IGNORE RDNS without using the get ips() function to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, obtain greylist treatment, or skip an antibot challenge.

Recommendations Update to version 1.6.13.