A critical vulnerability identified as CVE-2026-61511 has been addressed in vBulletin, a popular forum software. This flaw enables unauthenticated attackers to remotely execute PHP code, posing significant risks to affected forum servers. The vulnerability impacts versions 6.2.1 and earlier, as well as 6.1.6 and earlier.
Understanding the Vulnerability
The issue is located within the /includes/vb5/template/runtime.php file, particularly in the vB5_Template_Runtime::runMaths() method. This function is tasked with processing values associated with vBulletin’s {vb:math} template tag. Although a regular expression is employed to filter inputs, it falls short of preventing the execution of harmful code.
The inadequate filtering allows certain characters to bypass restrictions, leading to potentially unsafe evaluations of PHP code. Attackers can employ “PHPFuck” techniques, enabling them to craft function names and commands without using prohibited alphabetic characters, thus exploiting the vulnerability.
Potential Exploitation and Impact
Exploitation does not necessitate administrative privileges, as attackers can leverage the ajax/render/[template] route. Specifically, templates containing the {vb:math} tag with malicious data can be manipulated. For instance, the ‘pagenav’ template assigns a request parameter to a variable, which may ultimately reach the vulnerable runMaths() function.
Successful exploitation allows attackers to execute system-level commands, potentially leading to data breaches, website defacement, malware installation, credential theft, or deeper network infiltration. It is crucial for public-facing vBulletin forums to receive prompt updates to mitigate these risks.
Recommended Actions and Future Precautions
The vulnerability was brought to light by independent researchers collaborating with SSD Secure Disclosure, prompting vBulletin to release a fix in version 6.2.2. Administrators are urged to upgrade to this version or apply patches for versions 6.2.1, 6.2.0, and 6.1.6 without delay.
Organizations should scrutinize web-server logs for abnormal requests, particularly those related to ajax/render/pagenav, routestring, or unusual pagenav[pagenumber] values. Security teams need to be vigilant for signs of compromise, such as unexpected PHP files, unauthorized outbound connections, suspicious server processes, altered templates, or unauthorized admin accounts.
Proactive measures, including regular software updates and monitoring, are vital to safeguarding forum servers from such vulnerabilities. As cyber threats continue to evolve, maintaining robust security protocols remains a critical defense strategy.
