CVE-2025-48828 and CVE-2026-61511 in vBulletin allow attackers to execute arbitrary PHP code through unauthenticated Remote Code Execution (RCE).
vBulletin is a commercial, self-hosted forum platform written in PHP and 2 CVE impact it. CVE-2025-48828: Template Conditional Bypass RCE It is a Remote Code Execution vulnerability in vBulletin's template engine. Attackers can execute arbitrary PHP code by abusing Template Conditionals through alternative PHP function invocation syntax—specifically using the "var_dump"("test") style notation rather than standard syntax. This crafted template code bypasses security checks designed to prevent unauthorized function calls, allowing complete server compromise without any authentication. The vulnerability exploits CWE-424 (Improper Protection of Alternate Path), meaning the security filters don't account for all possible code execution paths. This flaw was confirmed as exploited in the wild in May 2025, with scanning and exploitation attempts detected starting May 25, 2025. CVE-2026-61511: Eval Injection in Template Runtime It is a Critical unauthenticated Remote Code Execution vulnerability affecting vBulletin 5.x and 6.x versions. The flaw exists in the vB5_Template_Runtime::runMaths() method, which applies an insufficiently restrictive regex filter before passing user input to PHP's dangerous eval() function. Attackers exploit this by sending specially crafted requests to the publicly accessible ajax/render AJAX endpoint with malicious input in the pagenav[pagenumber] parameter. Using phpfuck-style encoding—a technique that constructs arbitrary PHP expressions using only characters that pass the regex filter—attackers completely bypass the whitelist and execute arbitrary PHP code. This is exploitable with zero authentication, zero user interaction, and low attack complexity, making it extremely dangerous. A public Proof-of-Concept was released on July 27, 2026.
