vBulletin {vb:math} runMaths eval injection, unauthenticated RCE (public exploit)

CVE-2026-61511 — vBulletin: an arithmetic-only regex filter in front of eval() yields unauthenticated RCE, with a working exploit now public

The flaw is a textbook case of an allowlist that is not restrictive enough to be an allowlist. vB5_Template_Runtime::runMaths() in /includes/vb5/template/runtime.php backs vBulletin's {vb:math} inline-arithmetic template tag; it strips input down to digits, parentheses, arithmetic operators and a handful of binary operators — the XOR operator among them — and then hands the survivor straight to PHP's eval(). SSD Secure Disclosure's advisory states plainly that "[t]he '$str' parameter is not sufficiently sanitized before being used in an eval() call", and the remaining character set is enough to rebuild arbitrary PHP function names and string arguments character by character with no letters at all, using the operator-only construction technique the write-up calls "phpfuck" (SSD Secure Disclosure, 2026-07-27).

What turns a template-engine bug into a pre-auth one is the delivery path. {vb:math} can be reached by an administrator editing a style, which would be uninteresting, but SSD demonstrates it "can also be exploited by unauthenticated attackers by abusing the \"ajax/render/[template]\" route, rendering a template which uses {vb:math} with an user-tainted parameter" — and the stock pagenav template is exactly such a template, computing the previous page number from a visitor-supplied value (SSD Secure Disclosure, 2026-07-27). VulnCheck, the CNA for this CVE, describes the same path — naming the pagenav[pagenumber] parameter and the unauthenticated ajax/render route — classifies it as eval injection (CWE-95) at CVSS 4.0 9.3, and gives the affected range as vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.2.1 (VulnCheck, 2026-07-27). No login, no administrative session and no victim interaction are involved; the published proof of concept drives an interactive command shell over the primitive.

The timing is the risk, not the novelty. The vendor announced Patch Level 1 releases for 6.2.1, 6.2.0 and 6.1.6 on 2026-06-30, told anyone on an older version to move to 6.2.1 Patch Level 1, and noted that "vBulletin Cloud has been already been patched" (vBulletin, 2026-06-30); SSD's advisory points at that announcement and at the 6.2.2 release as the vendor response without dating either (SSD Secure Disclosure, 2026-07-27), but the discloser's own advisory carries a dated disclosure timeline recording the patch on 2026-06-30 and the 6.2.2 release on 2026-07-01 (Karma(In)Security, 2026-07-27). The fix therefore predates the public exploit by about four weeks, and the population still at risk is self-hosted forums that have not applied it — a category that skews heavily toward association, community, education and municipal sites on slow patch cycles. BSI CERT-Bund relayed the flaw to its constituents on 2026-07-27, describing an anonymous remote attacker able to execute arbitrary code and classing the advisory "kritisch" in the structured CSAF record it publishes for WID-SEC-2026-2528 (BSI CERT-Bund, 2026-07-27). No source claims in-the-wild exploitation yet; the item is carried because a working unauthenticated exploit for internet-facing PHP software is public and the fix diff hands over the technique.

Detection here is unusually clean, because the payload cannot look like normal input. Legitimate pagination values are short integers; an operator-only payload is a long run of parentheses, digits and arithmetic and XOR characters. In web-server access and application logs, the signal is a request to the site root carrying routestring=ajax/render/pagenav together with a pagenav[pagenumber] value that is not a small integer — the two together have essentially no benign counterpart, which makes this a discriminator rather than a heuristic. Back that with process-creation telemetry on the web host for child processes spawned by the PHP worker serving vBulletin, since successful exploitation ends in command execution as the web-server user. For instances that genuinely cannot be patched immediately, rejecting non-numeric characters in that parameter at a reverse proxy is a stopgap, not a fix: the vulnerable sink is the template engine itself, and any other template that feeds user input into {vb:math} is an equivalent path.