What’s Vulnerable › Vulnerabilities

CVE-2025-47916

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 84.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-05-16 · updated 2026-06-17
• Weakness: CWE-1336

Description

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.

Affected products

• Invisioncommunity: from 5.0.0 before 5.0.7 — fixed in 5.0.7

How to fix

Upgrade to a fixed version: Invisioncommunity 5.0.7. Check the vendor advisory for mitigations.

References

• https://invisioncommunity.com/release-notes-v5/507-r41/
• https://karmainsecurity.com/KIS-2025-02
• http://seclists.org/fulldisclosure/2025/May/4
• https://karmainsecurity.com/KIS-2025-02

Get alerted when CVE-2025-47916 or the next vulnerability affects your stack