---
schema: 1
kind: vulnerability
title: "CVE-2026-61511 — vBulletin: an arithmetic-only regex filter in front of eval() yields unauthenticated RCE, with a working exploit now public"
headline: "Working pre-auth RCE exploit published for vBulletin's {vb:math} template tag, four weeks after the patch"
summary: >
  SSD Secure Disclosure published full mechanics and a working exploit on 2026-07-27 for CVE-2026-61511, an
  eval-injection flaw in vBulletin's template runtime: vB5_Template_Runtime::runMaths() filters input to
  digits, parentheses and arithmetic/binary operators and then passes it to PHP's eval(), a character set
  wide enough to reconstruct arbitrary function calls without a single letter. It is reachable with no
  authentication through the public ajax/render route via the stock pagenav template, affecting vBulletin
  5.0.0 through 5.7.5 and 6.0.0 through 6.2.1. The vendor shipped Patch Level 1 releases on 2026-06-30 and 6.2.2 on 2026-07-01, so the
  exposed population is forum operators who have not applied a four-week-old update; BSI CERT-Bund classes
  its advisory "kritisch" and no in-the-wild exploitation is reported yet.
discovered_at: "2026-07-28T04:49:00Z"
event_date: "2026-07-27"
run_id: 2026-07-28T0409Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, poc-public, patch-available]
regions: [global]
sectors: [public-sector, education, technology]
entities: []
techniques: [T1190, T1059]
affected_products: ["vBulletin"]
cves:
  - id: CVE-2026-61511
    cvss: "9.3"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [poc-public, patch-available]
    affected: "vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.2.1 per the VulnCheck CNA advisory; SSD's advisory states the affected set more narrowly as 6.2.1 and prior plus 6.1.6 and prior. vBulletin Cloud instances were patched before disclosure."
    fixed: "Patch Level 1 releases for 6.2.1, 6.2.0 and 6.1.6, announced by the vendor on 2026-06-30, which also states vBulletin Cloud was already patched; the vendor directs anyone on an older version to upgrade to 6.2.1 Patch Level 1. The fix is also carried in 6.2.2, which the discloser's own timeline dates to 2026-07-01."
sources:
  - url: "https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/"
    publisher: "SSD Secure Disclosure"
    date: "2026-07-27"
    role: primary
  - url: "https://www.vulncheck.com/advisories/vbulletin-eval-injection-rce-via-vb5-template-runtime-php"
    publisher: "VulnCheck (CNA advisory)"
    date: "2026-07-27"
    role: corroborating
  - url: "https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6"
    publisher: "vBulletin (vendor security announcement)"
    date: "2026-06-30"
    role: primary
  - url: "https://karmainsecurity.com/KIS-2026-13"
    publisher: "Karma(In)Security (Egidio Romano)"
    date: "2026-07-27"
    role: primary
  - url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2528"
    publisher: "BSI CERT-Bund (WID-SEC-2026-2528)"
    date: "2026-07-27"
    role: corroborating
closed_sources: []
evidence:
  - quote: "The \u201c$str\u201d parameter is not sufficiently sanitized before being used in an eval() call."
    publisher: "SSD Secure Disclosure"
  - quote: "However, this can also be exploited by unauthenticated attackers by abusing the \u201cajax/render/[template]\u201d route, rendering a template which uses {vb:math} with an user-tainted parameter."
    publisher: "SSD Secure Disclosure"
  - quote: "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in vBulletin ausnutzen, um beliebigen Programmcode auszuführen."
    publisher: "BSI CERT-Bund (WID-SEC-2026-2528)"
  - quote: "Note: vBulletin Cloud has been already been patched."
    publisher: "vBulletin (vendor security announcement)"
verification: multi-source
sourcing_note: "SSD Secure Disclosure is the coordinating discloser and publishes the root-cause analysis and proof of concept (reliability B — an original vulnerability-research publication, not a first-party vendor authority). The VulnCheck CNA advisory and BSI CERT-Bund's advisory corroborate independently, so credibility is 1. The severity word \"kritisch\" is BSI's own aggregate_severity value in the CSAF document for WID-SEC-2026-2528, fetched this run through the documented CSAF transport for that source; the rendered HTML advisory at the cited URL carries the German description quoted here but does not display a severity label. Two further sourcing details: the CVSS 4.0 score of 9.3 and the CWE-95 eval-injection classification come from VulnCheck as CNA and are not stated by SSD; and the affected range differs between sources, with VulnCheck giving 5.0.0 through 5.7.5 and 6.0.0 through 6.2.1 while SSD's advisory lists only the 6.x branches, so the wider CNA range is the one used here. The identifier was additionally verified against the NVD record during this run. No party reports in-the-wild exploitation as of publication."
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 1
watchlist_hit: false
actions:
  - "Apply the vendor's Patch Level 1 release for vBulletin 6.2.1, 6.2.0 or 6.1.6 (or move to 6.2.2, which carries the same fix) on every self-hosted instance; 5.0.0 through 5.7.5 installations are in the CNA-listed affected range and no cited source names a fixed 5.x build — the vendor's own instruction for older versions is to upgrade to 6.2.1 Patch Level 1, so treat those as a migration rather than a patch."
migrated_from: null
---

The flaw is a textbook case of an allowlist that is not restrictive enough to be an allowlist. `vB5_Template_Runtime::runMaths()` in `/includes/vb5/template/runtime.php` backs vBulletin's `{vb:math}` inline-arithmetic template tag; it strips input down to digits, parentheses, arithmetic operators and a handful of binary operators — the XOR operator among them — and then hands the survivor straight to PHP's `eval()`. SSD Secure Disclosure's advisory states plainly that "[t]he '$str' parameter is not sufficiently sanitized before being used in an eval() call", and the remaining character set is enough to rebuild arbitrary PHP function names and string arguments character by character with no letters at all, using the operator-only construction technique the write-up calls "phpfuck" ([SSD Secure Disclosure, 2026-07-27](https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/)).

What turns a template-engine bug into a pre-auth one is the delivery path. `{vb:math}` can be reached by an administrator editing a style, which would be uninteresting, but SSD demonstrates it "can also be exploited by unauthenticated attackers by abusing the \"ajax/render/[template]\" route, rendering a template which uses {vb:math} with an user-tainted parameter" — and the stock `pagenav` template is exactly such a template, computing the previous page number from a visitor-supplied value ([SSD Secure Disclosure, 2026-07-27](https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/)). VulnCheck, the CNA for this CVE, describes the same path — naming the `pagenav[pagenumber]` parameter and the unauthenticated `ajax/render` route — classifies it as eval injection (CWE-95) at CVSS 4.0 9.3, and gives the affected range as vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.2.1 ([VulnCheck, 2026-07-27](https://www.vulncheck.com/advisories/vbulletin-eval-injection-rce-via-vb5-template-runtime-php)). No login, no administrative session and no victim interaction are involved; the published proof of concept drives an interactive command shell over the primitive.

The timing is the risk, not the novelty. The vendor announced Patch Level 1 releases for 6.2.1, 6.2.0 and 6.1.6 on 2026-06-30, told anyone on an older version to move to 6.2.1 Patch Level 1, and noted that "vBulletin Cloud has been already been patched" ([vBulletin, 2026-06-30](https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6)); SSD's advisory points at that announcement and at the 6.2.2 release as the vendor response without dating either ([SSD Secure Disclosure, 2026-07-27](https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/)), but the discloser's own advisory carries a dated disclosure timeline recording the patch on 2026-06-30 and the 6.2.2 release on 2026-07-01 ([Karma(In)Security, 2026-07-27](https://karmainsecurity.com/KIS-2026-13)). The fix therefore predates the public exploit by about four weeks, and the population still at risk is self-hosted forums that have not applied it — a category that skews heavily toward association, community, education and municipal sites on slow patch cycles. BSI CERT-Bund relayed the flaw to its constituents on 2026-07-27, describing an anonymous remote attacker able to execute arbitrary code and classing the advisory "kritisch" in the structured CSAF record it publishes for WID-SEC-2026-2528 ([BSI CERT-Bund, 2026-07-27](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2528)). No source claims in-the-wild exploitation yet; the item is carried because a working unauthenticated exploit for internet-facing PHP software is public and the fix diff hands over the technique.

Detection here is unusually clean, because the payload cannot look like normal input. Legitimate pagination values are short integers; an operator-only payload is a long run of parentheses, digits and arithmetic and XOR characters. In web-server access and application logs, the signal is a request to the site root carrying `routestring=ajax/render/pagenav` together with a `pagenav[pagenumber]` value that is not a small integer — the two together have essentially no benign counterpart, which makes this a discriminator rather than a heuristic. Back that with process-creation telemetry on the web host for child processes spawned by the PHP worker serving vBulletin, since successful exploitation ends in command execution as the web-server user. For instances that genuinely cannot be patched immediately, rejecting non-numeric characters in that parameter at a reverse proxy is a stopgap, not a fix: the vulnerable sink is the template engine itself, and any other template that feeds user input into `{vb:math}` is an equivalent path.