Critical vBulletin Flaw Lets Unauthenticated Attackers Execute PHP Code Remotely

vBulletin has patched CVE-2026-61511, a critical remote code execution flaw that could let unauthenticated attackers execute arbitrary PHP code and compromise vulnerable forum servers. This issue affects vBulletin versions 6.2.1 and earlier as well as versions 6.1.6 and earlier. The flaw exists in the file /includes/vb5/template/runtime.php, specifically within the vB5_Template_Runtime::runMaths() method. This function processes values used by vBulletin’s {vb:math} template tag. The vulnerable code attempts to restrict input with a regular expression before passing the result to PHP’s eval() function. However, the filtering is inadequate, allowing characters such as digits, parentheses, arithmetic operators, binary operators, and...

Read the full article at the source.