Executive brief
vBulletin, a widely used internet forum software, contains a critical security flaw that allows unauthorized individuals to take complete control of the server. By sending a specially crafted web request to a specific page navigation component, an attacker can execute malicious commands without needing a username or password. This could lead to the theft of user data, website defacement, or a total service shutdown.
Technical details
An eval injection vulnerability exists in the vB5_Template_Runtime::runMaths() method within vBulletin's template engine. The root cause is an insufficiently restrictive regular expression filter in /includes/vb5/template/runtime.php that intended to permit only mathematical operators and digits but failed to block 'phpfuck-style' encoding. An unauthenticated remote attacker can exploit this by sending crafted input via the 'pagenav[pagenumber]' parameter through the 'ajax/render' template route. This allows the attacker to bypass the regex filter and execute arbitrary PHP code with the privileges of the web server. The issue is resolved in vBulletin version 6.2.2 and via security patches for older supported versions.
Affected products
- vBulletin vBulletin 5.0.0 through 5.7.5, 6.0.0 through 6.2.1
Timeline
- 2026-06-25: disclosed: Vendor notified by SSD Secure Disclosure
- 2026-06-30: patched: Security patch released for 6.2.1, 6.2.0, and 6.1.6
- 2026-07-01: patched: Version 6.2.2 released
- 2026-07-27: advisory: Public disclosure and CVE assignment
References
- https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6
- https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509404-vbulletin-6-2-2-is-available
- https://karmainsecurity.com/KIS-2026-13
- https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/
- https://www.vulncheck.com/advisories/vbulletin-eval-injection-rce-via-vb5-template-runtime-php