Loading vulnerability…
PHP code execution through vBulletin Template Conditionals
CVE-2025-48828 is a code-injection vulnerability in the vBulletin template engine. Crafted Template Conditionals can bypass unsafe-function checks through alternative PHP function invocation syntax, allowing arbitrary PHP code execution. A reported unauthenticated exploit chain combines this flaw with CVE-2025-48827, a protected API method invocation vulnerability, to inject malicious advertisement templates through replaceAdTemplate(). Reported affected releases include vBulletin 5.0.0–5.7.5 and 6.0.0–6.0.3 before applicable security patches. Exploitation was reported in May 2025, although contemporaneous observations confirmed attempts against CVE-2025-48827 without establishing successful execution of the complete chain.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary PHP execution on the forum server. The reported exploit chain can provide shell access under the web server account and may result in critical data loss and compromise of system confidentiality, integrity, and availability. The extent of compromise depends on the permissions available to the compromised server process.
If you can’t patch tonight, do this now.
Review vBulletin, network, and security-device logs for exploitation attempts. This is a detection measure, not a substitute for patching; no verified preventive workaround is specified.
Patch, then assume compromise.
Apply the applicable vBulletin security updates or upgrade to a supported, fixed release. Reported likely fixes include vBulletin 6.0.3 Patch Level 1, 6.0.2 Patch Level 1, 6.0.1 Patch Level 1, and 5.7.5 Patch Level 3. Versions 6.1.1 and 6.1.2 are also identified as unaffected or recommended upgrade destinations. The historical patch-level identification is qualified as likely rather than conclusively verified for every release.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.