CVE-2026-61511
Received Received - Intake

eval injection in vBulletin 5.x through 6.2.1

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulnCheck

Description
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-61511
EUVD
EUVD-2026-49312

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
vbulletin vbulletin to 6.2.2 (exc)
vbulletin vbulletin to 6.2.1 (inc)
vbulletin vbulletin 5.x
vbulletin vbulletin 6.x
vbulletin vbulletin From 5.0 (inc) to 5.7.5 (inc)
vbulletin vbulletin From 6.0 (inc) to 6.2.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61511 is a Remote Code Execution (RCE) flaw in vBulletin versions 5.x through 5.7.5 and 6.x through 6.2.1. It exists in the vB5_Template_Runtime::runMaths() method where insufficient input sanitization allows arbitrary PHP code execution via an eval() call. Attackers exploit this by injecting crafted input through the pagenav[pagenumber] parameter using phpfuck-style encoding.

Detection Guidance

Check vBulletin versions for affected releases (5.x through 5.7.5 or 6.x through 6.2.1). Inspect server logs for unusual activity in the ajax/render route or template modifications. Look for malicious {vb:math} tags in templates or requests to pagenav[pagenumber] with phpfuck-style payloads.

Impact Analysis

Unauthenticated attackers can execute arbitrary PHP code on the server, potentially gaining full control over the system. This could lead to data theft, defacement, malware installation, or further network compromise. Even authenticated users with template editing privileges could exploit it.

Compliance Impact

This RCE vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules for protected health information. Organizations may face regulatory fines, legal liabilities, and reputational damage if exploited.

Mitigation Strategies

Upgrade vBulletin to version 6.2.2 or later immediately. If upgrading is not possible, apply the vendor patch released on June 30, 2026. Disable the ajax/render route temporarily and review all templates for unauthorized {vb:math} tags or suspicious code.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61511. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart