Reported by 1 outlet

Timeline

1. original reporting

   Critical vBulletin Pre-Auth RCE Flaw Enables Arbitrary PHP Code Execution

   cyberpress.org · 29d ago · September 14th, 2026

   A critical vulnerability in vBulletin lets unauthenticated remote attackers execute arbitrary PHP code on a vulnerable forum server, creating a direct path to server compromise. Tracked as CVE-2026-61511, the issue affects vBulletin 6.2.1 and earlier, as well as version 6.1.6 and earlier. The flaw was disclosed on July 27, 2026, by a researcher working with SSD Secure Disclosure. It resides in the template runtime component, in vB5_Template_Runtime::runMaths() in /includes/vb5/template/runtime.php . At the center of the vulnerability is an unsafe eval() operation. Before evaluating a supplied expression, the application applies a restrictive regular expression. Critical vBulletin Pre-Auth RCE Flaw However, the filter still permits digits, parentheses, periods, arithmetic operators, and binary operators, including XOR. Those permitted primitives are sufficient for PHP expression-obfuscation techniques that can construct callable values and arguments without alphabetic function names. Attacker-controlled data can therefore reach eval() in a form that supports execution of semi-arbitrary PHP instructions directly . Template editing through the administrative interface can trigger the vulnerable code, but the pre-authentication attack surface is more serious. An attacker does not need administrator credentials when a publicly reachable template-rendering endpoint can be induced to pass tainted input to a math tag. SSD Secure Disclosure identified the ajax/render/[template] route