Live › vulnerability › CVE-2019-17132
Go to dashboardvBulletin through 5.5.4 mishandles custom avatar image uploads, so a crafted invalid image can lead to code injection on the server. A Cloudflare WAF rule named for this CVE moved from Log to Block, which suggests the flaw is reachable over HTTP.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 17:33 UTC, 1h before NVD. All times on this page are UTC.
Sites running vBulletin at or below 5.5.4 are exposed through the custom avatar handling. The sources do not say whether a logged-in account is needed or whether custom avatars must be enabled, so treat any vBulletin install in the range as in scope until checked.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vbulletin | vendor | <= 5.5.4 | – |
<= 5.5.45.5.4 using the vendor update (the fixed version is not stated in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-08-11 · Changelog
New updates and improvements at Cloudflare.
August 11, 2026
This release introduces new protection for a remote code execution vulnerability in vBulletin and improves two existing detections.
Key Findings
Impact
Successful exploitation of CVE-2026-61511 may lead to remote code execution on affected vBulletin systems, potentially resulting in unauthorized access, data exposure, service disruption, and broader compromise of the hosting environment. Administrators are strongly encouraged to apply vendor updates and recommended mitigations.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...94f3006b | N/A | vBulletin - Remote Code Execution - CVE:CVE-2026-61511 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...098b749e | N/A | Version Control - Information Disclosure - Beta | Log | Block | This rule is merged into the original rule "Version Control - Information Disclosure" (ID: ...0550c529) |
| Cloudflare Managed Ruleset | ...d56225d8 | N/A | vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132 - Beta | Log | Block | This rule is merged into the original rule "vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132" (ID: ...8fe9f1c7) |
This page as .md · .json · in your agent: get_signal("CVE-2019-17132")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.