CVE-2026-61511: vBulletin runtime template runMaths pre-auth RCE
CVE-2026-61511 is verified against the affected target vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00307.
pruva-verify REPRO-2026-00307 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00307/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Provisional research ticket for a pre-authentication RCE described by SSD Disclosure as 'vbulletin runtime template runMaths preauth rce'. The SSD page itself was not extractable in this environment (robot challenge), so the ticket is chained from public corroboration: vBulletin's template runtime exposes vB_Template_Runtime::runMaths(), the template engine allows conditional/function evaluation, and public search results point to a new pre-auth vBulletin RCE family with public PoC disclosure in 2026. The likely root cause is unsafe evaluation of attacker-controlled template/runtime expressions in the template rendering path, enabling code execution without authentication. This ticket should be validated against the exact affected versions, entrypoint, and patch level once a reproducible source or archived copy of the SSD article is available.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.