What is the CVSS score of CVE-2025-48827?

CVE-2025-48827 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 69.4%.

Which versions of PHP are affected by CVE-2025-48827?

Organizations using 5.0.0 face critical risk from CVE-2025-48827 rated CVSS 10.0. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.

Is there a public PoC exploit available for CVE-2025-48827?

Yes, a public proof-of-concept exploit is available for CVE-2025-48827. Prioritise patching immediately. EPSS: 69.4%.

How to fix or mitigate CVE-2025-48827?

Within 24 hours: Identify all affected systems running 5.0.0 and apply vendor patches immediately. Monitor vendor channels for patch availability.

PHP CVE-2025-48827

CRITICAL

Improper Protection of Alternate Path (CWE-424)

2025-05-27 cve@mitre.org

Information Disclosure PHP Vbulletin

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:44 vuln.today

PoC Detected

Jun 25, 2025 - 16:46 vuln.today

Public exploit code

CVE Published

May 27, 2025 - 04:15 nvd

CRITICAL 10.0

DescriptionCVE.org

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.

AnalysisAI

vBulletin versions 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 are vulnerable to remote code execution through crafted template conditional expressions. Attackers abuse PHP's alternative function invocation syntax to bypass template engine security checks and execute arbitrary PHP code, as actively exploited in the wild in May 2025.

Technical ContextAI

The vBulletin template engine supports conditional expressions that are evaluated server-side. Security checks prevent direct function calls, but PHP's alternative invocation syntax ("function_name"("argument")) is not filtered. Attackers craft template code using this syntax to execute arbitrary PHP functions including system(), file_get_contents(), and eval(). The exploitation has been observed in the wild since May 2025.

RemediationAI

Update to vBulletin 5.7.6 or 6.0.4 immediately. Review template customizations for suspicious expressions. Audit user-controlled template fields for injection attempts. Monitor PHP error logs for template evaluation failures that may indicate exploitation attempts.