vBulletin Template Runtime PHP Code Injection

CVE-2026-61511 is a critical unauthenticated remote code execution vulnerability affecting vBulletin 5.x and 6.x installations. The vulnerability exists in the vB5_Template_Runtime::runMaths() method, where an insufficiently restrictive regex filter fails to properly sanitize the pagenav[pagenumber] parameter. Attackers can bypass input validation using phpfuck-style encoding—a technique that represents PHP code using only permitted characters—to inject and execute arbitrary PHP code on the server. With a CVSS score of 9.8, this vulnerability poses an immediate threat to any organization running vulnerable vBulletin versions, as exploitation requires no authentication and can lead to complete server compromise, data theft, and lateral movement into internal networks.

While MITRE ATT&CK techniques are not formally mapped to this CVE, Casky's AI-powered analysis framework would detect the attack patterns underlying this vulnerability by identifying code injection and command execution behaviors. Practitioners using Casky would observe findings related to unsafe input handling, regex bypass techniques, and dynamic code execution (eval/assert patterns). The platform's extended reasoning capability would correlate the phpfuck encoding obfuscation tactic with CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) to surface how attackers transform benign-appearing characters into malicious PHP payloads. Security teams would see detailed intelligence on exploitation chains, parameter manipulation patterns, and indicators of compromise that reveal when attackers attempt to exploit this template runtime flaw in their environment.