A critical security vulnerability has been identified in vBulletin, a widely used forum software, which allows unauthenticated attackers to execute arbitrary PHP code remotely. This flaw, designated as CVE-2026-61511, affects vBulletin versions 6.2.1 and earlier, as well as versions 6.1.6 and earlier.
The vulnerability resides in the file /includes/vb5/template/runtime.php, specifically within the vB5_Template_Runtime::runMaths() method. This function processes values used by vBulletin’s {vb:math} template tag. The issue arises from inadequate input filtering before passing data to PHP’s eval() function. Although the system attempts to restrict input using a regular expression, it fails to block certain characters, including digits, parentheses, arithmetic operators, binary operators, and the XOR operator.
As a result, attackers can exploit this flaw using techniques such as “PHPFuck” to construct function names and commands without directly using blocked alphabetic characters. This allows them to execute arbitrary PHP code on the server.
Exploitation Details
Exploiting this vulnerability does not require administrator access. An attacker can utilize the ajax/render/[template] route to render a template containing a {vb:math} tag with attacker-controlled data. For instance, the pagenav template assigns the pagenav[pagenumber] request parameter to a template variable, which is later used in a mathematical expression that reaches the vulnerable runMaths() function.
A specially crafted request can lead the server to evaluate attacker-controlled PHP expressions, enabling the execution of operating-system commands under the permissions of the web server process. This level of access could result in data theft, website defacement, malware deployment, credential harvesting, or lateral movement within the hosting environment.
Mitigation and Recommendations
vBulletin has addressed this vulnerability in version 6.2.2 and has provided patches for earlier supported releases. Administrators are strongly advised to update to vBulletin version 6.2.2 or apply the vendor-provided patches for affected versions 6.2.1, 6.2.0, and 6.1.6.
Organizations should also monitor web-server logs for unusual requests related to ajax/render/pagenav, routestring, or unexpected pagenav[pagenumber] values. Security teams are encouraged to investigate signs of compromise, including newly created PHP files, unexpected outbound connections, suspicious web-server child processes, altered templates, and unauthorized administrator accounts.
This incident underscores the importance of regular software updates and vigilant monitoring of web applications. Forum administrators must prioritize patching to protect their platforms from potential exploitation.
