PHP eval injection in vBulletin template runtime runMaths() (CVE-2026-61511)

vBulletin contains an eval injection vulnerability in the `vB5_Template_Runtime::runMaths()` method within `/includes/vb5/template/runtime.php`, where user-supplied input is insufficiently sanitized before being passed to `eval()`. An insufficiently restrictive regex filter can be bypassed using phpfuck-style encoding with permitted characters, allowing unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input via the `pagenav[pagenumber]` parameter through the unauthenticated `ajax/render` template route. Public POC available. Affected versions: - Version 5.7.5 and prior 5.x versions - Version 6.2.1 and prior 6.x versions We recommend updating to: 6.2.2. CVSS 9.3 · our assessment: act_now Reference: https://karmainsecurity.com/KIS-2026-13 Details: https://vuln.today/cve/CVE-2026-61511