Description
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.
Published: 2026-07-27
Score: 9.3 Critical
EPSS: 1.7% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a PHP eval injection in the vB5_Template_Runtime::runMaths() method. An unauthenticated attacker can supply crafted input through the pagenav[pagenumber] parameter, bypassing an overly permissive regex filter. This leads to arbitrary PHP code execution within the application. The weakness corresponds to CWE-95.

Affected Systems

vBulletin vBulletin – versions 5.x through 5.7.5, and 6.x through 6.2.1 are affected. Versions 6.2.2 and later are not vulnerable.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. The EPSS score of 1% indicates a low but non-zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. Attackers do not need authentication and can trigger the flaw via the unauthenticated AJAX/render template route, making exploitation possible for any remote user. Given the high severity and lack of mitigation on legacy installations, patching is urgent.

Generated by OpenCVE AI on August 4, 2026 at 14:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest security patch to upgrade vBulletin to version 6.2.2 or newer (or the 6.1 patch if using a 6.1 release).
  • If an immediate upgrade is not feasible, restrict or block access to the AJAX/render template endpoint—e.g., via firewall rules—to prevent unauthenticated payload delivery.
  • Deploy a web application firewall rule or similar mechanism to detect and block suspicious eval injection patterns in incoming requests to the pagenav parameter, thereby reducing the attack surface without requiring a full upgrade.

Generated by OpenCVE AI on August 4, 2026 at 14:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 28 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*

Mon, 27 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Vbulletin
Vbulletin vbulletin
Vendors & Products Vbulletin
Vbulletin vbulletin

Mon, 27 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Description vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.
Title vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
Weaknesses CWE-95
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Vbulletin Vbulletin
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-07T05:32:22.940Z

Reserved: 2026-07-10T15:43:36.627Z

Link: CVE-2026-61511

cve-icon Vulnrichment

Updated: 2026-08-07T05:32:22.940Z

cve-icon NVD

Status : Deferred

Published: 2026-07-27T14:16:59.177

Modified: 2026-08-07T06:16:56.993

Link: CVE-2026-61511

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T14:15:10Z

Weaknesses
  • CWE-95

    Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')