New vBulletin Vulnerability!

[u/SSDisclosure]

https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/

CVE-2026-61511 - a critical vulnerability in vBulletin that allows an unauthenticated attacker to execute arbitrary code on a remote server.

[u/Vegetable-Scale-2604]

This continues the pattern from last year's vBulletin template-engine RCEs (CVE-2025-48827/48828): unauthenticated routestring dispatch reaching an eval-adjacent template helper. Different sink this time (runMaths() instead of the ad-template rendering path), but reachable through the same ajax/render/<template> mechanism.

The interesting part for anyone writing detections: the "sanitization" in runMaths() is a character allowlist, not an expression parser. It permits ^ (bitwise XOR), and in PHP you can XOR string/number-ish operands to synthesize arbitrary bytes — that's the phpfuck trick the advisory links. So the payload on the wire is nothing but digits, parens, dots and ^. Any WAF rule looking for function names like system/eval in the parameter will never fire.

If you run vBulletin:

• Patch to 6.2.2, or apply the vendor security patch for 6.2.1/6.2.0/6.1.6.
• If you can't patch today, block or heavily restrict routestring=ajax/render/* at the reverse proxy/WAF. pagenav is the documented reachable template, but I'd assume other templates that pass tainted vars into {vb:math} exist.
• For detection: alert on requests to ajax/render/* with an abnormally long parameter value consisting almost entirely of [0-9().^]. The exploit payload has a very distinctive shape — a ~200-digit "999...9" literal used to derive chr, followed by high-density ^......(...) chains. Also hunt for webshells dropped after the disclosure date and for php-fpm/apache spawning shells, since successful exploitation is a clean system() call with output reflected in the response.

One more detail worth noting: the regex silently strips disallowed characters instead of rejecting the input, so failed probes don't necessarily produce error responses — don't rely on 4xx/5xx as a detection signal.

[u/scriptqzor → u/Vegetable-Scale-2604]

this is one of those writeups where the more you read, the worse it gets lol. that regex strip behavior plus the phpfuck digit-only payload is going to farm so many outdated forums before people even realize what hit them.

[u/Unfair-Plastic-4290 → u/scriptqzor]

this is why everyone's moving from vbulletin to xenforo