CVE-2025-48828

CVE-2025-48828 is a flaw in vBulletin's template engine in which Template Conditionals do not properly restrict PHP function invocation, letting attackers run arbitrary PHP code on the server. A remote attacker triggers it by crafting template code that calls PHP functions using an alternative invocation syntax, such as "var_dump"("test"), which bypasses the security checks that normally limit executable code in templates. Successful exploitation yields arbitrary PHP execution in the context of the web application (CVSS 8.1 High, with high confidentiality, integrity and availability impact), typically enabling remote code execution on the hosting server. Certain vBulletin versions are affected; the CVSS vector indicates the attack is network-based, requires no privileges or user interaction, but has high attack complexity. The flaw was exploited in the wild in May 2025, a public proof-of-concept write-up is available, EPSS puts the 30-day exploitation probability at 57.6% (99th percentile), though it is not yet in CISA's KEV catalog.

What to do: Upgrade affected forums to the vendor's patched release as soon as possible, since this flaw was exploited in the wild in May 2025 and a public PoC is available. Until patched, check templates and access logs for signs of the alternative PHP invocation syntax (e.g., "function"("args")) and consider WAF/virtual-patching rules on forum template endpoints; afterwards, review the server for signs of compromise such as unexpected files or scheduled tasks.