---
id: CVE-2026-61511
title: >-
  vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection
  vulnerability in the vB5_Template_Runtime::runMaths() method within the
  template runtime that allows unauthenticated remote attackers to execute
  arbitrary PHP c…
summary: >-
  vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection
  vulnerability in the vB5_Template_Runtime::runMaths() method within the
  template runtime that allows unauthenticated remote attackers to execute
  arbitrary PHP c…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-95
published: '2026-07-27'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T04:18:24.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61511'
references:
  - url: >-
      https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6
    label: disclosure@vulncheck.com
  - url: >-
      https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509404-vbulletin-6-2-2-is-available
    label: disclosure@vulncheck.com
  - url: 'https://karmainsecurity.com/KIS-2026-13'
    label: disclosure@vulncheck.com
  - url: >-
      https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vbulletin-eval-injection-rce-via-vb5-template-runtime-php
    label: disclosure@vulncheck.com
  - url: 'http://seclists.org/fulldisclosure/2026/Aug/29'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.05607
epssPercentile: 0.92751
exploits:
  github: 5
  githubRepos:
    - 'https://github.com/tc4dy/CVE-2026-61511-PoC-Exploit'
    - 'https://github.com/puj790201-lab/cve-2026-61511'
    - 'https://github.com/HORKimhab/CVE-2026-61511'
  nuclei:
    - CVE-2026-61511
  checkedAt: '2026-10-14T05:15:02.605Z'
exploitAvailable: true
ingestedAt: '2026-10-14T05:14:27.624Z'
---

## Overview

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.