Vulnerability · Published Jul 27, 2026 · Assigned by VulnCheck

CVE-2026-61511vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

Critical 9.8

In plain English

A critical-severity security flaw in vBulletin from vBulletin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.6% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)5.6%top 7.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.

Affected products (as reported)

Vendor	Product	Versions
vBulletin	vBulletin	5.0.0 – through 5.7.56.0.0 – through 6.2.1

Weakness: CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Karma(In)Security Disclosure technical-description, exploit
SSD Secure Disclosure technical-description, exploit
6.2.1, 6.2.0, 6.1.6 Security Announcement
6.2.2 Release Notes
https://www.vulncheck.com/advisories/vbulletin-eval-injection-rce-via-vb5-template-runtime-php third-party-advisory
http://seclists.org/fulldisclosure/2026/Aug/29