vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability
• Software Link:
• Affected Versions:
Version 5.7.5 and prior 5.x versions.
Version 6.2.1 and prior 6.x versions.
• Vulnerability Description:
The vulnerable code is located within the /includes/vb5/template/runtime.php script.
Specifically, into the vB5_Template_Runtime::runMaths() method:
1 public static function runMaths($str)
2 {
3 [...]
4
5 $str = preg_replace('#([^+\-*=/\(\)\d\^<>&|\.]*)#', '', $str);
6
7 if (empty($str))
8 {
9 $str = '0';
10 }
11 else
12 {
13 [...]
14
15 try
16 {
17 $status = @eval("\$str = $str;");
18 }
19 catch(Error $e)
20 {
21 $status = false;
22 }The $str parameter is not sufficiently sanitized before being used in an eval() call at line 17. The regex used to validate the input parameter (at line 5) will filter the string only allowing for digits, parentheses, math and binary operators (the XOR, particularly). As such, this can be exploited to inject and execute (semi) arbitrary PHP code through “phpfuck” techniques.
The vulnerability could be exploited by e.g. administrator users, by editing a template/style in the admin panel and adding a specially crafted {vb:math} tag (which is a sort of wrapper around the vB5_Template_Runtime::runMaths() method).
However, this can also be exploited by unauthenticated attackers by abusing the ajax/render/[template] route, rendering a template which uses the {vb:math} tag with an user-tainted parameter. One of the possible templates that can be abused that way is the default “pagenav” template:
[...]
<vb:elseif condition="isset($pagenav['pagenumber'])" />
{vb:set pagenav.currentpage, {vb:raw pagenav.pagenumber}}
</vb:if>
[...]
<vb:if condition="$pagenav['currentpage'] != 1">
<a class="js-pagenav-button [...] data-page="{vb:math {vb:var pagenav.currentpage} - 1}"
Here, user input passed through the pagenav[pagenumber] parameter will be assigned to the “pagenav.currentpage” template variable, which is later used within a {vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method, which in turn will pass this string to eval(), eventually resulting in execution of (semi) arbitrary PHP code on the web server.
• Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-61511.php
• Solution:
Apply the vendor patch or upgrade to version 6.2.2 or later.
• Disclosure Timeline:
[25/06/2026] – Vendor was notified by SSD Secure Disclosure
[30/06/2026] – Vendor released security patch to address this issue: https://tinyurl.com/vb-patch
[01/07/2026] – Vendor released version 6.2.2: https://tinyurl.com/vb-622
[13/07/2026] – CVE identifier requested
[13/07/2026] – CVE identifier assigned
[27/07/2026] – Public disclosure
• CVE Reference:
CVE-2026-61511 has been assigned to this vulnerability.
• Credits:
Vulnerability discovered by Egidio Romano.
• Other References:
https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/