Skip to content
Verified reproduction

CVE-2026-61511: vBulletin runtime template runMaths pre-auth RCE

CVE-2026-61511 is verified against the affected target vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00307.

REPRO-2026-00307 RCE Jul 27, 2026 CVE entry .txt
Severity CRITICAL
Confidence HIGH
Reproduced in 139m 11s
Tool calls 826
Spend $69.44
$ pruva-verify REPRO-2026-00307
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00307/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

Provisional research ticket for a pre-authentication RCE described by SSD Disclosure as 'vbulletin runtime template runMaths preauth rce'. The SSD page itself was not extractable in this environment (robot challenge), so the ticket is chained from public corroboration: vBulletin's template runtime exposes vB_Template_Runtime::runMaths(), the template engine allows conditional/function evaluation, and public search results point to a new pre-auth vBulletin RCE family with public PoC disclosure in 2026. The likely root cause is unsafe evaluation of attacker-controlled template/runtime expressions in the template rendering path, enabling code execution without authentication. This ticket should be validated against the exact affected versions, entrypoint, and patch level once a reproducible source or archived copy of the SSD article is available.

03 · Root cause
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.

bundle/logs/coding/coding-live-3-variant-benign.json0.9 KB
bundle/logs/coding/coding-live-3-variant-attack.json38.4 KB
bundle/repro/validation_verdict.json0.8 KB
bundle/logs/coding/coding-live-3-http.log0.1 KB
bundle/logs/coding/coding-live-3-source-identity.txt0.5 KB
bundle/logs/coding/coding-live-3-parent-benign.json0.5 KB
bundle/logs/coding/coding-live-3-parent-attack.json0.5 KB
bundle/repro/rca_report.md10.1 KB
bundle/logs/repro/php70-positive-1-proof.log0.2 KB
bundle/logs/repro/php70-positive-1-marker.txt0.0 KB
bundle/logs/repro/php70-positive-1-exploit-response.txt15.3 KB
bundle/repro/runtime_manifest.json1.6 KB
bundle/logs/repro/vb515-runmaths-source.txt2.2 KB
bundle/logs/repro/vb515-pagenav-source.txt2.6 KB
bundle/repro/reproduction_steps.sh21.4 KB
bundle/repro/discovery_manifest.json2.6 KB
bundle/logs/repro/durable-positive-4-exploit-response.txt15.3 KB
bundle/logs/repro/durable-positive-4-source-identity.txt0.9 KB
bundle/logs/repro/durable-positive-4-health.txt0.4 KB
bundle/logs/repro/durable-positive-4-baseline-request.trace1.9 KB
bundle/logs/repro/durable-positive-4-payload.txt81.2 KB
bundle/logs/repro/durable-positive-4-mysql.log0.3 KB
bundle/logs/repro/durable-positive-4-apache-stdout.log0.2 KB
bundle/logs/repro/durable-positive-4-apache-error.log0.5 KB
bundle/logs/repro/durable-positive-4-apache-access.log0.3 KB
bundle/coding/proposed_fix.diff13.2 KB
bundle/coding/verify_fix.sh11.7 KB
bundle/coding/summary_report.md5.9 KB
bundle/logs/coding/coding-live-3-proof.log0.4 KB
bundle/logs/coding/coding-live-3-observation.json0.3 KB
bundle/logs/coding/coding-live-3-unit.log1.4 KB