CVE-2025-48828: vBulletin template engine allows arbitrary PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS score is 8.1 (HIGH), the flaw is exploited in the wild, and EPSS is above the 99th percentile, but it is not in CISA KEV and requires high attack complexity.

What it is

Certain vBulletin versions allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code using an alternative PHP function invocation syntax, such as "var_dump"("test"), attackers can bypass security checks and run arbitrary PHP code. The flaw was exploited in the wild in May 2025.

Impact

An attacker can execute arbitrary PHP code on the server, leading to full compromise of the vBulletin installation and potentially the underlying host. This can result in data theft, web shell deployment, or further lateral movement.

Attack surface

The vulnerability is reachable over the network via the template engine, with no authentication or user interaction required according to the CVSS vector (AV:N/PR:N/UI:N). The attack complexity is rated high (AC:H), likely due to the need to craft specific template code.

Exploitation

The record states the flaw was exploited in the wild in May 2025, and an exploit reference is tagged. It is not listed in CISA KEV, but EPSS is 0.57367 (99th percentile), indicating high likelihood of exploitation.

What to do

• Apply the latest security patch from vBulletin as soon as it is available.
• If patching is not immediately possible, restrict access to the vBulletin admin control panel and template editing features to trusted IPs.
• Disable or restrict the use of Template Conditionals if feasible without breaking functionality.
• Monitor for and remove any unauthorized template modifications or PHP code injections.
• Consider using a web application firewall (WAF) to block known exploit patterns targeting this vulnerability.

Detection

• Inspect vBulletin templates for unusual PHP function calls or alternative invocation syntax (e.g., "var_dump"("test")).
• Monitor web server logs for requests containing suspicious template-related parameters or PHP code patterns.
• Use file integrity monitoring to detect changes to template files or unexpected PHP files in the web root.
• Review server processes for unexpected PHP execution or outbound connections that may indicate a web shell.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.