Critical Security Flaw in vBulletin: Remote Code Execution Risk
Exploit code released for patched vBulletin vulnerability.
1Vulnerability Discovery
Technical details published on July 27 revealed an authentication-free remote code execution flaw in vBulletin forum software. The vulnerability allows reaching PHP's eval() function through a math function in the template engine. vBulletin versions 6.2.1 and earlier are affected.
2Patch Timeline
vBulletin released version 6.2.2 in late June to fix this vulnerability. However, a 4-week gap existed between the patch and exploit publication. While cloud instances update automatically, self-hosted forum administrators must apply updates manually.
3Technical Details
The flaw resides in the runMaths() method within /includes/vb5/template/runtime.php. It bypasses restricted character filters to execute PHP code. Attackers can manipulate math expressions via the ajax/render/pagenav route to run arbitrary code on the server.
4Impact Assessment
SSD reports no active exploitation observed yet. However, a similar vBulletin flaw was widely exploited in 2025. No official risk score exists as the CVE record remains incomplete. The exploit code is now publicly available.
5Mitigation Steps
Administrators should immediately upgrade to version 6.2.2. As temporary measures, monitor ajax/render/pagenav requests. Long math expressions or operator-heavy pagenav[pagenumber] values should raise suspicion. vBulletin Cloud users benefit from automatic protection.
6Broader Implications
This incident highlights risks of silently patched but slowly updated vulnerabilities in popular software. vBulletin's template engine has faced similar issues before. Forum administrators who don't apply regular updates remain at significant risk.
Original article: The Hacker News — vBulletin'de Kritik Güvenlik Açığı: Uzaktan Kod Çalıştırma Riski