---
id: "CVE-2019-17132"
kind: "vulnerability"
aliases: ["CVE-2019-17132"]
title: "vBulletin: custom avatar handling lets attackers run code remotely"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "vbulletin", "fixed": [], "affected": "<= 5.5.4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cloudflare", "lab-disclosure", "other", "self-hosted", "vbulletin"]
not_affected_if: []
published_at: "2019-10-04T12:15:11+00:00"
first_seen_at: "2026-10-24T17:33:06+00:00"
updated_at: "2026-10-25T05:29:19+00:00"
sources: [{"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-08-11-waf-release/", "first_seen_at": "2026-10-24T17:33:06+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17132", "first_seen_at": "2026-10-24T18:53:56+00:00"}]
---

# vBulletin: custom avatar handling lets attackers run code remotely

vBulletin through 5.5.4 mishandles custom avatar image uploads, so a crafted invalid image can lead to code injection on the server. A Cloudflare WAF rule named for this CVE moved from Log to Block, which suggests the flaw is reachable over HTTP.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:vbulletin affected <= 5.5.4 fixed ?

## How to check

- Check the installed vBulletin version against the affected range `<= 5.5.4`
- Check whether custom avatar uploads are enabled in the vBulletin admin control panel (the sources do not say this is required)

## Fix

- Move vBulletin past `5.5.4` using the vendor update (the fixed version is not stated in the sources)
- If you cannot patch now, keep the Cloudflare WAF managed rule for CVE-2019-17132 in Block mode (the sources do not describe other mitigations)

## Timeline

- 2026-10-24T17:33:06+00:00 lab https://developers.cloudflare.com/changelog/post/2026-08-11-waf-release/ — Cloudflare: WAF Release - 2026-08-11 · Changelog
- 2026-10-24T18:53:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-17132

## Documents

- [advisory] Cloudflare: WAF Release - 2026-08-11 · Changelog https://developers.cloudflare.com/changelog/post/2026-08-11-waf-release/

## From the sources

WAF Release - 2026-08-11 · Changelog

# Changelog

New updates and improvements at Cloudflare.

August 11, 2026

## WAF Release - 2026-08-11

This release introduces new protection for a remote code execution vulnerability in vBulletin and improves two existing detections.

Key Findings

- A new detection provides protection against vBulletin CVE-2026-61511.
- Two existing detections have been improved to strengthen coverage.

Impact

Successful exploitation of CVE-2026-61511 may lead to remote code execution on affected vBulletin systems, potentially resulting in unauthorized access, data exposure, service disruption, and broader compromise of the hosting environment. Administrators are strongly encouraged to apply vendor updates and recommended mitigations.

| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
| --- | --- | --- | --- | --- | --- | --- |
| Cloudflare Managed Ruleset | ...94f3006b | N/A | vBulletin - Remote Code Execution - CVE:CVE-2026-61511 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...098b749e | N/A | Version Control - Information Disclosure - Beta | Log | Block | This rule is merged into the original rule "Version Control - Information Disclosure" (ID: ...0550c529) |
| Cloudflare Managed Ruleset | ...d56225d8 | N/A | vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132 - Beta | Log | Block | This rule is merged into the original rule "vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132" (ID: ...8fe9f1c7) |

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_