What’s Vulnerable › Vulnerabilities

CVE-2017-17672

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 15.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-12-14 · updated 2026-06-17
• Weakness: CWE-502

Description

In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.

Affected products

• vBulletin: from 5.0.1 through 5.3.3; 5.0.0-beta_11, 5.0.0-beta_28

References

• https://blogs.securiteam.com/index.php/archives/3573
• https://www.exploit-db.com/exploits/43362/
• https://blogs.securiteam.com/index.php/archives/3573
• https://www.exploit-db.com/exploits/43362/

Get alerted when CVE-2017-17672 or the next vulnerability affects your stack