{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "vBulletin",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----------------------------------------------------------------\nvBulletin \u003c= 6.2.1 (runMaths) Remote Code Execution Vulnerability\n-----------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.vbulletin.com\n\n\n[-] Affected Versions:\n\nVersion 5.7.5 and prior 5.x versions.\nVersion 6.2.1 and prior 6.x versions.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/includes/vb5/template/runtime.php script. Specifically, into the\nvB5_Template_Runtime::runMaths() method: the $str parameter is not\nsufficiently sanitized before being used in an eval() call. The regex used\nto validate the input parameter will filter the string only allowing for\ndigits, parentheses, math and binary operators (the XOR, particularly). As\nsuch, this can be exploited to inject and execute (semi) arbitrary PHP code\nthrough \"phpfuck\" techniques. The vulnerability could be exploited by e.g.\nadministrator users, by editing a template/style in the admin panel and\nadding a specially crafted {vb:math} tag (which is a sort of wrapper around\nthe vB5_Template_Runtime::runMaths() method). However, this can also be\nexploited by unauthenticated attackers by abusing the\najax/render/[template] route, rendering a template which uses the {vb:math}\ntag with an user-tainted parameter. One of the possible templates that can\nbe abused that way is the default \"pagenav\" template: here, user input\npassed through the \"pagenav[pagenumber]\" parameter will be assigned to the\n\"pagenav.currentpage\" template variable, which is later used within a\n{vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method,\nwhich in turn will pass this string to eval(), eventually resulting in\nexecution of (semi) arbitrary PHP code on the web server.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-61511.php\n\n\n[-] Solution:\n\nApply the vendor patch or upgrade to version 6.2.2 or later.\n\n\n[-] Disclosure Timeline:\n\n[25/06/2026] - Vendor was notified by SSD Secure Disclosure\n[30/06/2026] - Vendor released security patch to address this issue:\nhttps://tinyurl.com/vb-patch\n[01/07/2026] - Vendor released version 6.2.2: https://tinyurl.com/vb-622\n[13/07/2026] - CVE identifier requested\n[13/07/2026] - CVE identifier assigned\n[27/07/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-61511 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-13\n\n\n[-] Other References:\n\nhttps://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/29"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/29"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-13"
        },
        {
          "url": "https://karmainsecurity.com/pocs/CVE-2026-61511.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/"
        },
        {
          "url": "https://tinyurl.com/vb-622"
        },
        {
          "url": "https://tinyurl.com/vb-patch"
        },
        {
          "url": "https://www.vbulletin.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/29"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-13] vBulletin \u003c= 6.2.1 (runMaths) Remote Code Execution Vulnerability",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0038",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/29",
            "automated": true,
            "contentSha256": "f552a77da0b58d8b73f63dd07d383c31adfeb589892e4c5dc3324e305eb50047",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/29",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-27T11:04:04Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0038"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}