vBulletin 6.x - Remote Code Execution
CVE-2026-61511
Verified
Description
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection vulnerability caused by insufficiently restrictive regex filtering in vB5_Template_Runtime::runMaths(), letting unauthenticated remote attackers execute arbitrary PHP code via the pagenav[pagenumber] parameter in ajax/render template route.
Severity
Critical
Exploit Probability
6%
Affected Product
vbulletin
Published Date
August 23, 2026
Template Author
alex700, 0x_akoko
CVE-2026-61511.yaml
9.5Severity
CVSS Metrics
CVE ID:
cve-2026-61511
CWE ID:
cwe-94
Remediation Steps
Update to a version later than 5.7.5 for 5.x and later than 6.2.1 for 6.x or the latest available version.