Loading vulnerability…
Unauthenticated eval injection RCE in vBulletin template runtime
CVE-2026-61511 is an eval injection vulnerability affecting unpatched vBulletin 5.x through 5.7.5 and 6.x through 6.2.1. The vB5_Template_Runtime::runMaths() method insufficiently sanitizes its $str argument before passing it to PHP eval(). Its regular-expression filter permits characters, including XOR operators, that can be combined using phpfuck-style encoding to construct executable PHP expressions. The default pagination template passes attacker-controlled pagenav[pagenumber] input through a {vb:math} tag into the vulnerable method. The public AJAX template-rendering route exposes this execution path without authentication, enabling remote PHP code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables server-side PHP execution and potentially operating-system command execution under the permissions of the web-server process. Consequences can include forum data theft, credential harvesting, website defacement, and malware deployment. Lateral movement within the hosting environment is also a possible consequence, but is not established as an observed outcome. Technical descriptions vary between arbitrary and semi-arbitrary PHP execution.
If you can’t patch tonight, do this now.
Monitor web-server logs for unusual template-rendering requests and unexpected pagination parameter values. Investigate newly created PHP files, unexpected outbound connections, suspicious web-server child processes, altered templates, and unauthorized administrator accounts. These measures support detection and incident response rather than preventing exploitation; no specific preventive workaround is established.
Patch, then assume compromise.
Upgrade to vBulletin 6.2.2 or later, or apply the vendor's security patches released for vBulletin 6.2.1, 6.2.0, and 6.1.6, identified as Patch Level 1. Fixes for the affected 5.x branch are not expected; migrate those installations to a fixed, supported release rather than assuming a 5.x patch is available.
3 exploits validated by Mallory's analysis. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.