A significant vulnerability in vBulletin allows unauthenticated remote attackers to execute arbitrary PHP code on a vulnerable forum server, providing a direct route to server compromise This article explores significant vulnerability vbulletin. . This issue, tracked as CVE-2026-61511, affects versions 6.2.1 and earlier, as well as 6.1.6 and earlier.
The vulnerability lies in the template runtime component, specifically in vB5_Template_Runtime::runMaths() located in /includes/vb5/template/runtime.php. However, it still allows digits, parentheses, periods, arithmetic operators, binary operators, including XOR, and certain permitted primitives. Specifically, the pagenav template's pagenav[pagenumber] parameter is assigned to pagenav.currentpage, which is subsequently used in a {vb:math} expression to calculate a page value.
Successful exploitation could allow a threat actor to execute operating-system commands via PHP, deploy a web shell, steal forum databases and configuration secrets, alter site content, or pivot into adjacent systems accessible from the server. They should review logs for unusual POST requests, unexpected pagenav values, PHP child processes, and newly created files and outbound connections from forum hosts. Until updates are deployed, restricting public access to template-rendering endpoints through a web application firewall or reverse-proxy rule can help mitigate exposure, but it does not replace patching.
