CVE-2026-61511: vBulletin Template Runtime RCE Vulnerability

CVE-2026-61511 Overview

CVE-2026-61511 is an eval injection vulnerability affecting vBulletin 5.x through 5.7.5 and 6.x through 6.2.1. The flaw resides in the vB5_Template_Runtime::runMaths() method within the template runtime. Unauthenticated remote attackers can execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. The vulnerability is reachable via the unauthenticated ajax/render template route, requiring no credentials or user interaction. The issue is tracked as CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code.

Critical Impact
Unauthenticated attackers can achieve remote code execution on vulnerable vBulletin forums by bypassing a regex filter with phpfuck-style character encoding.

Affected Products

vBulletin 5.x through 5.7.5
vBulletin 6.x through 6.1.5
vBulletin 6.2.0 and 6.2.1

Discovery Timeline

2026-07-27 - CVE-2026-61511 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-61511

Vulnerability Analysis

The vulnerability exists in the vB5_Template_Runtime::runMaths() method, which processes mathematical expressions embedded in vBulletin templates. The method applies a regex filter intended to restrict input to safe characters before passing the expression to PHP's eval(). The filter is insufficiently restrictive and permits characters that can be composed into a valid PHP payload. Attackers exploit this by supplying crafted input to the pagenav[pagenumber] parameter, which flows into runMaths() during template rendering. The ajax/render endpoint reaches this code path without requiring authentication.

Root Cause

The root cause is direct use of eval() against user-controlled input combined with an inadequate allow-list regex. The filter fails to prevent phpfuck-style obfuscation, a technique that constructs arbitrary PHP using a very small character set. Because the permitted character set is not disjoint from the character set required to build executable PHP, attackers can synthesize function calls and code execution primitives entirely from allowed characters. This matches the CWE-95 pattern of improper neutralization of directives in dynamically evaluated code.

Attack Vector

An attacker sends a single HTTP request to the ajax/render template route with a crafted pagenav[pagenumber] value containing a phpfuck-encoded PHP payload. The vBulletin backend passes this value to runMaths(), applies the flawed regex, and evaluates the resulting string. Successful exploitation yields arbitrary PHP execution in the context of the web server process. No authentication, session, or user interaction is required. Public technical write-ups are available in Karma Insecurity Report KIS-2026-13, the SSD Disclosure advisory, and the VulnCheck RCE Advisory.

Detection Methods for CVE-2026-61511

Indicators of Compromise

HTTP requests to /ajax/render/ template routes containing pagenav[pagenumber] parameters with non-numeric payloads.
Request bodies or query strings containing unusual clusters of characters such as !, +, (, ), [, ], _ used in phpfuck-style encoding.
Web server processes spawning shell interpreters, curl, wget, or writing files to web-accessible directories after ajax/render traffic.
New or modified PHP files under vBulletin webroot directories following inbound traffic to the render endpoint.

Detection Strategies

Inspect web server access logs for ajax/render requests where pagenav[pagenumber] is longer than a small integer or contains non-digit characters.
Deploy WAF rules that reject pagenav[pagenumber] values not matching ^[0-9]+$.
Correlate PHP-FPM or Apache child process behavior with preceding requests to identify code execution triggered from the render endpoint.

Monitoring Recommendations

Alert on outbound network connections initiated by the PHP or web server user immediately following requests to ajax/render.
Monitor file integrity on the vBulletin core/ and template directories for unexpected writes.
Track authentication and privilege changes on forum administrator accounts that may follow exploitation.

How to Mitigate CVE-2026-61511

Immediate Actions Required

Upgrade vBulletin to a patched build listed in the vBulletin Security Patch Announcement or move to vBulletin 6.2.2.
Audit the webroot and template directories for unauthorized PHP files and webshells prior to patching.
Rotate administrator credentials, API keys, and database secrets accessible to the vBulletin process after remediation.

Patch Information

vBulletin has released fixes for versions 6.1.6, 6.2.0, and 6.2.1 via the official security patch, and version 6.2.2 supersedes affected builds. Administrators running vBulletin 5.x through 5.7.5 should plan migration paths because the 5.x branch is included in the affected range. Refer to the vendor announcements linked above for the exact patch application procedure.

Workarounds

Block or filter requests to /ajax/render/ at an upstream reverse proxy or WAF where the pagenav[pagenumber] parameter contains any non-digit character.
Restrict access to the forum administration and AJAX endpoints to trusted IP ranges until patching is complete.
Disable or remove custom templates that expose the runMaths() code path if the deployment permits it.

bash

# Example NGINX rule to reject non-numeric pagenav[pagenumber] values
location ~ ^/ajax/render/ {
    if ($args ~* "pagenav(\[|%5B)pagenumber(\]|%5D)=[^0-9&]") {
        return 403;
    }
    # proxy_pass or fastcgi_pass to backend here
}