vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
vBulletin · vBulletin
vBulletin versions 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection flaw in the vB5_Template_Runtime::runMaths() method of the template runtime (vb5/template/runtime.php). An unauthenticated remote attacker can reach it over the network through the ajax/render template route by supplying crafted pagenav[pagenumber] input, using encoded PHP that passes an insufficient regex filter, to run arbitrary PHP code on the server without authentication or user interaction.
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 31 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+1 day
- First seen exploitedVulnCheck KEV evidence+31 days
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 5 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw [The Hacker News]1 Aug 2026
- Kritiek lek in forumsoftware vBulletin maakt remote code execution mogelijk [Security.NL maakt Nederland veilig]31 Jul 2026
- JetBrains TeamCity CVE-2026-63077 Unauthenticated RCE31 Jul 2026
- vBulletin CVE-2026-61511 Pre-Auth Template RCE (Public PoC)29 Jul 2026
- vBulletin CVE-2026-61511 Pre-Auth Template Engine RCE (Public Exploit)28 Jul 2026