CVE-2026-61511 — a public exploit revealed on July 27 — demonstrates an unauthenticated request can reach PHP's eval() inside vBulletin and execute code on an unpatched forum server.
How the vulnerability works inside vB5_Template_Runtime::runMaths()
SSD Secure Disclosure's technical analysis locates the vulnerable code in /includes/vb5/template/runtime.php, within the vB5_Template_Runtime::runMaths() method. That function handles inline math in templates, applying an allowlist that removes characters outside a restricted set and then passing the remainder directly to PHP's eval(). The filter blocks letters but permits digits, parentheses, concatenation, arithmetic operators and binary operators such as XOR. Using that small permitted set, an attacker can reconstruct PHP strings and callable names without any letters through a restricted-character technique the advisory calls "phpfuck."
The public attack chain: ajax/render/pagenav → {{vb:math}} → eval()
Reaching runMaths() does not require administrative credentials. vBulletin renders templates over the public route ajax/render/pagenav, and the stock pagenav template copies a visitor-supplied pagenav[pagenumber] value into a {{vb:math}} tag, which is passed to runMaths(). SSD's proof-of-concept (PoC) uses that chain to rebuild PHP's system function and run an operating-system command, returning the command output in the HTTP response. In short: a public POST to the ajax/render/pagenav route carrying a specially crafted pagenav[pagenumber] value can convert a template bug into pre-authentication remote code execution.
Proof-of-concept details, the one-character error, and attribution
SSD published an interactive PoC and identified the issue as CVE-2026-61511, crediting an unnamed independent researcher. The published exploit is signed "EgiX," the handle of Egidio Romano, who previously disclosed a 2025 template-engine code-execution chain. The PoC as posted contains a single-character mistake — a letter where a digit belongs — that prevents it from running unchanged; the advisory says the error is trivial to correct and does not affect the underlying vulnerability. The Hacker News reproduced the disclosed filtering and evaluation logic locally: with the typo corrected, a harmless strlen() test payload executed; without correction, the allowlist stripped the stray letter and left syntactically invalid PHP. SSD did not report active exploitation.
Patch history, timelines, and where live risk remains
vBulletin issued security patches for 6.2.1, 6.2.0, and 6.1.6 at the end of June and released the fixed version 6.2.2 on July 1 — nearly four weeks before the exploit went public on July 27. vBulletin says its Cloud sites have already been patched against the flaw. SSD Secure Disclosure lists vBulletin 6.2.1 and earlier, and 6.1.6 and earlier as affected but does not give a lower-version boundary. The exploit's own banner calls the issue a zero-day, but the vendor patches and the 6.2.2 release preceded public disclosure by nearly four weeks; in other words, the exploit code is new while the underlying flaw had already been fixed.
What this means for self-hosted administrators, vBulletin Cloud customers, and security teams
- Self-hosted administrators: The live risk is concentrated in self-hosted, internet-facing forums that have not applied the late‑June fixes or upgraded to 6.2.2. Administrators running self-hosted installations should apply the patch for their branch or upgrade to 6.2.2.
- vBulletin Cloud customers: According to vBulletin, Cloud sites have already been patched against the flaw; those customers should verify vendor notices and normal change logs.
- Security teams and defenders: Review POST requests carrying routestring=ajax/render/pagenav with unusually long or operator-heavy pagenav[pagenumber] values — a detection pattern derived from the public PoC rather than vendor guidance. Note that SSD did not report active exploitation, and as of July 27 no source had confirmed in‑the‑wild attacks; CVE-2026-61511 was not listed in CISA's Known Exploited Vulnerabilities catalog, and no NVD record or CVSS score was available at the time of writing.
This is not the first time vBulletin's template engine has produced pre-authentication code execution. The May 2025 chain (CVE-2025-48827 and CVE-2025-48828) abused the engine through a different path and drew exploitation attempts within days of disclosure, after a quiet vendor patch months earlier that many forums had not applied. The pattern has repeated: a quiet fix is released, a working exploit surfaces weeks later, and some internet-facing forums remain vulnerable.
For defenders the immediate, practical steps are clear and narrow: confirm platform versions, apply the released fixes for your branch or upgrade to 6.2.2, and monitor ajax/render/pagenav traffic for anomalous pagenav[pagenumber] payloads that match the public PoC's characteristics. The public record does not settle whether the flaw was used in the roughly four weeks between the late‑June patch and the July 27 disclosure; neither SSD's advisory nor vBulletin's notices address that window. That unresolved interval — combined with repeated history — is the specific risk administrators must manage now.
