vBulletin: eval injection in runMaths() (CVE-2026-61511)
The vBulletin template runtime method vB5_Template_Runtime::runMaths() contains an eval injection. A weak regex filter can be bypassed with phpfuck-style encoding. Through the pagenav[pagenumber] parameter and the ajax/render route, an unauthenticated attacker can execute arbitrary PHP code. CVSS 9.3.
Checked in Shield: no
Who is affected
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1. No authentication is required to exploit it.
How to check
Check your installed vBulletin version against the affected ranges. Also confirm whether vBulletin is used in any of your other projects.
How to fix
A fixed version has not been disclosed yet. Follow official vBulletin announcements and apply the patch once it is released.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Patch availability and real-world exploitation are not disclosed yet. Source: NVD (CVE-2026-61511).
