EIP-2026-104474

PRE-CVE

vBulletin 5.x - 'routestring' Remote Code Execution

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104474. PoCs published by SecuriTeam.

AI-analyzed exploit summary This is a detailed technical analysis of an unauthenticated file inclusion vulnerability in vBulletin 5, leading to remote code execution. The writeup includes code snippets and explains the vulnerability's root cause in the routing mechanism.

Description

vBulletin 5.x - 'routestring' Remote Code Execution

Exploits (1)

exploitdb WRITEUP

by SecuriTeam · webappsmultiple

https://www.exploit-db.com/exploits/43361

View Code ZIP pw:eip

This is a detailed technical analysis of an unauthenticated file inclusion vulnerability in vBulletin 5, leading to remote code execution. The writeup includes code snippets and explains the vulnerability's root cause in the routing mechanism.

Classification

Writeup 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: vBulletin 5

No auth needed

Prerequisites: vBulletin 5 installation on a Windows server · Network access to the target

MITRE ATT&CK

T1189 - Drive-by Compromise T1210 - Exploitation of Remote Services

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026