Exploit Published for Already-Patched Pre-Auth RCE in vBulletin

On July 27, SSD Secure Disclosure published a technical breakdown and a working proof-of-concept for CVE-2026-61511 — an unauthenticated remote code execution flaw in the vBulletin forum engine. The attack requires no account, no administrative access and no involvement from another user: a single HTTP request is enough, one that ultimately reaches PHP's eval() function and runs a command on an unpatched server.

How the vulnerability works

The vulnerable code lives in /includes/vb5/template/runtime.php, in the vB5_Template_Runtime::runMaths() method, which processes inline math expressions in templates. The function strips out every character outside an allowed set and passes the remainder straight to eval(). The filter blocks letters but lets through digits, parentheses, concatenation, and arithmetic and bitwise operators, including XOR. That is enough to assemble strings and the names of callable functions without a single letter — a trick the report calls “phpfuck.”

The vulnerable code can be reached through the public ajax/render/pagenav route: a stock template inserts the visitor-supplied pagenav[pagenumber] value into a {vb:math} tag, from which it lands in runMaths(). The PoC uses this mechanism to reconstruct the system function and execute an OS command, returning the output in the HTTP response.

A “zero-day” that's already been patched

The exploit banner labels the find a zero-day, but that's an overstatement. Patches for the 6.2.1, 6.2.0 and 6.1.6 branches came out at the end of June, and the fixed version 6.2.2 landed on July 1 — nearly four weeks before publication. According to SSD, versions 6.2.1 and below, as well as 6.1.6 and below, are affected; the authors do not specify the lower bound. vBulletin's cloud sites are already protected, the vendor says.

SSD credits the discovery to an unnamed researcher, but the published code is signed “EgiX” — the alias of Egidio Romano, who previously disclosed a code-execution chain through vBulletin's template engine in 2025. A curious detail: the script contains a typo — a letter instead of a digit — that keeps it from running without an edit. The mistake is trivial and doesn't affect the vulnerability itself. The Hacker News reproduced the filtering logic locally: with the typo corrected, a harmless test payload strlen() ran fine; without it, the PHP remained syntactically invalid.

No signs of exploitation in real-world attacks had been recorded as of July 27, the vulnerability is not listed in the CISA KEV catalog, and there is no official CVSS score — the NVD stopped routinely enriching new CVEs with scores earlier this year.

A familiar scenario

This is not the first pre-auth RCE in this same corner of vBulletin: the May 2025 chain (CVE-2025-48827 and CVE-2025-48828) exploited the template engine along a different path and came under attack within days of disclosure. The pattern repeats time and again: first a quiet patch, then a working exploit a few weeks later — and by that point, plenty of internet-facing forums are still running vulnerable builds. The main risk right now is concentrated precisely in self-hosted, un-updated installations — administrators should apply the patch for their branch or move to 6.2.2.

Source: The Hacker News