Critical severity · published May 16, 2025
CVE-2025-47916
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php
9.8
CVSS
84.3%
EPSS
No
On KEV
Description
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)84.3% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Invision Power Board · invisioncommunity
5.0.0 before 5.0.7 · source: vendor
IN
Invisioncommunity · Invisioncommunity
5.0.0 before 5.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-47916
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-47916
Release Notes
https://invisioncommunity.com/release-notes-v5/507-r41/
Exploit
https://karmainsecurity.com/KIS-2025-02
Mailing List
http://seclists.org/fulldisclosure/2025/May/4
More from Invision Power Board
9.8
CVE-2013-3725
Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution
9.8
CVE-2012-2226
Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a…
9.8
CVE-2017-8898
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an…
8.8
CVE-2014-4928
SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter
8.1
CVE-2017-8899
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP