Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN797
_____________________________________________________________________

DATE                : 29/07/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running vBulletin versions prior to 6.2.2.
 
=====================================================================
https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6
https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509404-vbulletin-6-2-2-is-available
_____________________________________________________________________


Security Patch Released for vBulletin 6.2.1, 6.2.0 and 6.1.6
Tue 30 Jun '26, 10:16am

A security issue has been found in the template parsing functionality
of vBulletin 6.2.1. We have created a fix for the issue.

It is recommended that you apply this patch as soon as possible. To
do so, download the patch for your version from
https://members.vbulletin.com/patches.php and upload the included
files to your server. The process will overwrite existing files with
the new files provided.

    Note: Security patches may introduce false reports of altered
files in the Suspect Files Diagnostic.

Patches Released:

    vBulletin 6.2.1 Patch Level 1
    vBulletin 6.2.0 Patch Level 1
    vBulletin 6.1.6 Patch Level 1

If you are using an older version of vBulletin, you should upgrade to
vBulletin 6.2.1 Patch Level 1 as soon as possible.

_____________________________________________________________________


vBulletin 6.2.2 is available.
Wed 1 Jul '26, 12:59pm

vBulletin 6.2.2 is now available for self-hosted (download) customers.
vBulletin Cloud sites will be automatically upgraded over the
upcoming weeks.


Video Embedding

When an end user pastes a link to a video from a known video source
(e.g., YouTube or Vimeo) within a post, the video will automatically
be embedded. Previously, these would only provide a link to the
video. Known sources include all the types supported by the video
BBCode. This change is not retroactive and will only apply to new
content.


Video Tab

A Videos tab has been added to the Channel Display module. This tab
will display all posts with the Video/Link Content type. This will
make these posts easier to discover. This tab will appear
automatically on channels with unmodified module settings.
Administrators can also control the appearance of this tab by
editing the Channel Display module using Site Builder.


Trending Topics Digest

End users can subscribe to an email digest of trending topics on
their notifications tab. The appearance of this email is similar
to the pre-existing daily and weekly email digests. Administrators
can specify the number of posts included in this digest in the
AdminCP under Settings → Options → Message Searching. Update the
Trending Digest Size option.


Email Subscribers

When sending bulk email to users from the AdminCP, Administrators
can now search for Paid Subscriptions and their status. You can
filter based on a specific subscription, all subscriptions, active
subscriptions, or completed subscriptions.


Legacy Calendar Tables Removed

The legacy Calendar and Event tables from vBulletin 3.X and 4.X
will be removed from your database on upgrade. If you feel this
older data may be important, you will need to create backups of
it. This data is considered deprecated, and the functionality
has been superseded by the Event content type, Holiday Manager,
and Calendar modules in vBulletin 6.


Other Issues

    VB6-1570 - JavaScript error on IP address tab in profile
    VB6-1520 - Open Internal URLs in the Same Tab
    VB6-1541 - Find replace in phrases doesn’t work
    VB6-1537 - User ignore list can be deleted in some cases.
    VB6-1544 - Clean up obsolete phrases

Additional Information

Install / Upgrade

    Installation Instructions
    Upgrade Instructions

File Cleanup

After upgrading your vBulletin system, delete any obsolete files
that may still be present. You can find more information on why
this is needed and instructions for doing this in this topic in
the vBulletin 6 Installs & Upgrades forum.


System Requirements

Current Minimum System Requirements

    PHP Version: 8.2.0
    MySQL Version: 8.0.11
    MariaDB Version: 10.6.0

Recommended System Requirements

    PHP Version: 8.4+
    MySQL Version: 9.0+
    MariaDB Version: 11.4+

For more information, see vBulletin Connect System Requirements.


Current Support Schedule

    Active Version - 6.2.2
    Security Patch - 6.2.1
    Security Patch - 6.2.0


Discussion

If you have any questions about these changes, you may discuss
them here: https://forum.vbulletin.com/node/4509402

If you encounter an issue with the software or wish to submit
a feature request, please visit our tracker.

To receive support for your vBulletin Product, please visit
our community forums.


=========================================================

+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================