{"id":"CVE-2019-17132","kind":"vulnerability","aliases":["CVE-2019-17132"],"related":[],"title":"vBulletin: custom avatar handling lets attackers run code remotely","description":"WAF Release - 2026-08-11 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 11, 2026\n\n## WAF Release - 2026-08-11\n\nThis release introduces new protection for a remote code execution vulnerability in vBulletin and improves two existing detections.\n\nKey Findings\n\n- A new detection provides protection against vBulletin CVE-2026-61511.\n- Two existing detections have been improved to strengthen coverage.\n\nImpact\n\nSuccessful exploitation of CVE-2026-61511 may lead to remote code execution on affected vBulletin systems, potentially resulting in unauthorized access, data exposure, service disruption, and broader compromise of the hosting environment. Administrators are strongly encouraged to apply vendor updates and recommended mitigations.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...94f3006b | N/A | vBulletin - Remote Code Execution - CVE:CVE-2026-61511 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...098b749e | N/A | Version Control - Information Disclosure - Beta | Log | Block | This rule is merged into the original rule \"Version Control - Information Disclosure\" (ID: ...0550c529) |\n| Cloudflare Managed Ruleset | ...d56225d8 | N/A | vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132 - Beta | Log | Block | This rule is merged into the original rule \"vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132\" (ID: ...8fe9f1c7) |","summary":"vBulletin through 5.5.4 mishandles custom avatar image uploads, so a crafted invalid image can lead to code injection on the server. A Cloudflare WAF rule named for this CVE moved from Log to Block, which suggests the flaw is reachable over HTTP.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vbulletin","fixed":[],"affected":"<= 5.5.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","lab-disclosure","other","self-hosted","vbulletin"],"not_affected_if":[],"how_to_check":"- Check the installed vBulletin version against the affected range `<= 5.5.4`\n- Check whether custom avatar uploads are enabled in the vBulletin admin control panel (the sources do not say this is required)","fix":"- Move vBulletin past `5.5.4` using the vendor update (the fixed version is not stated in the sources)\n- If you cannot patch now, keep the Cloudflare WAF managed rule for CVE-2019-17132 in Block mode (the sources do not describe other mitigations)","status":"open","published_at":"2019-10-04T12:15:11+00:00","first_seen_at":"2026-10-24T17:33:06+00:00","triaged_at":"2026-10-25T05:29:18+00:00","updated_at":"2026-10-25T05:29:19+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:29:18Z","model":"claude-haiku-5-5","output":{"fix":"- Move vBulletin past `5.5.4` using the vendor update (the fixed version is not stated in the sources)\n- If you cannot patch now, keep the Cloudflare WAF managed rule for CVE-2019-17132 in Block mode (the sources do not describe other mitigations)","reach":"internet","title":"vBulletin: custom avatar handling lets attackers run code remotely","impact":"high","summary":"vBulletin through 5.5.4 mishandles custom avatar image uploads, so a crafted invalid image can lead to code injection on the server. A Cloudflare WAF rule named for this CVE moved from Log to Block, which suggests the flaw is reachable over HTTP.","category":"other","nicknames":[],"who_cares":["vbulletin","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"code runs on the server through a crafted avatar image","analyst_note":"Find the first fixed vBulletin version and whether custom avatar upload needs login or a non-default setting, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2019-17132 and the vendor advisory.","how_to_check":"- Check the installed vBulletin version against the affected range `<= 5.5.4`\n- Check whether custom avatar uploads are enabled in the vBulletin admin control panel (the sources do not say this is required)","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running vBulletin at or below 5.5.4 are exposed through the custom avatar handling. The sources do not say whether a logged-in account is needed or whether custom avatars must be enabled, so treat any vBulletin install in the range as in scope until checked.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001274,"input_tokens":3926,"output_tokens":1762,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-08':71C,87C '-11':72C,88C '-17132':12A,15A,244C,265C '-2019':11A,14A,243C,264C '-2026':117C,133C,195C '-61511':118C,134C,196C '0550c529':229C '098b749e':207C '11':82C '2026':70C,83C,86C '5.5.4':28B '8fe9f1c7':267C '94f3006b':187C 'access':149C 'action':180C,182C 'administr':161C 'affect':142C 'appli':166C 'attack':6A 'august':81C 'avatar':3A,31B 'beta':213C,245C 'block':59B,198C,215C,247C 'broader':155C 'changelog':73C,74C 'cloudflar':17B,48B,80C,184C,204C,230C 'code':8A,42B,97C,139C,191C,236C,257C 'comment':183C 'compromis':156C 'control':210C,225C 'coverag':127C 'craft':36B 'custom':2A,30B 'cve':10A,13A,54B,116C,132C,193C,194C,241C,242C,262C,263C 'd56225d8':233C 'data':150C 'descript':178C 'detect':106C,111C,121C,203C 'disclosur':20B,212C,227C 'disrupt':153C 'encourag':164C 'environ':160C 'execut':98C,140C,192C 'exist':105C,120C 'exploit':130C 'exposur':151C 'find':108C 'flaw':63B 'format':240C,261C 'handl':4A 'host':24B,159C 'http':67B 'id':174C,177C,228C,266C 'imag':32B,38B,239C,260C 'impact':128C 'improv':78C,103C,124C 'inform':211C,226C 'inject':43B,237C,258C 'introduc':91C 'invalid':37B,238C,259C 'key':107C 'lab':19B 'lab-disclosur':18B 'lead':40B,136C 'legaci':175C 'let':5A 'log':57B,197C,214C,246C 'manag':185C,205C,231C 'may':135C 'merg':219C,251C 'mishandl':29B 'mitig':171C 'move':55B 'n/a':188C,208C,234C 'name':51B 'new':75C,92C,110C,181C,202C 'origin':222C,254C 'potenti':145C 'previous':179C 'protect':93C,113C 'provid':112C 'reachabl':65B 'recommend':170C 'releas':69C,85C,90C 'remot':9A,96C,138C,190C 'result':146C 'rule':50B,173C,176C,217C,223C,249C,255C 'ruleset':172C,186C,206C,232C 'run':7A 'self':23B 'self-host':22B 'server':46B 'servic':152C 'strengthen':126C 'strong':163C 'success':129C 'suggest':61B 'system':144C 'two':104C,119C 'unauthor':148C 'updat':76C,168C 'upload':33B 'vbulletin':1A,16A,25B,26B,101C,115C,143C,189C,235C,256C 'vendor':167C 'version':209C,224C 'vulner':99C 'waf':49B,68C,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running vBulletin at or below 5.5.4 are exposed through the custom avatar handling. The sources do not say whether a logged-in account is needed or whether custom avatars must be enabled, so treat any vBulletin install in the range as in scope until checked.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2019-10-04T12:15:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-08-11-waf-release/#CVE-2019-17132","url":"https://developers.cloudflare.com/changelog/post/2026-08-11-waf-release/","severity":null,"published_at":"2026-08-11T17:32:58+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:33:06+00:00","fetched_at":"2026-10-24T17:33:06+00:00","note":"Cloudflare: WAF Release - 2026-08-11 · Changelog"},{"source":"nvd","external_id":"CVE-2019-17132","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17132","severity":null,"published_at":"2019-10-04T12:15:11+00:00","modified_at":"2026-06-17T02:23:22+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null}],"documents":[{"id":2856,"url":"https://developers.cloudflare.com/changelog/post/2026-08-11-waf-release/","title":"Cloudflare: WAF Release - 2026-08-11 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-08-11 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 11, 2026\n\n## WAF Release - 2026-08-11\n\nThis release introduces new protection for a remote code execution vulnerability in vBulletin and improves two existing detections.\n\nKey Findings\n\n- A new detection provides protection against vBulletin CVE-2026-61511.\n- Two existing detections have been improved to strengthen coverage.\n\nImpact\n\nSuccessful exploitation of CVE-2026-61511 may lead to remote code execution on affected vBulletin systems, potentially resulting in unauthorized access, data exposure, service disruption, and broader compromise of the hosting environment. Administrators are strongly encouraged to apply vendor updates and recommended mitigations.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...94f3006b | N/A | vBulletin - Remote Code Execution - CVE:CVE-2026-61511 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...098b749e | N/A | Version Control - Information Disclosure - Beta | Log | Block | This rule is merged into the original rule \"Version Control - Information Disclosure\" (ID: ...0550c529) |\n| Cloudflare Managed Ruleset | ...d56225d8 | N/A | vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132 - Beta | Log | Block | This rule is merged into the original rule \"vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132\" (ID: ...8fe9f1c7) |","published_at":"2026-08-11T17:32:58+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}