CVE-2025-47916 Scanner
Detects unauthenticated template injection in Invision Community ≤ 5.0.6 leading to RCE.
Short Info
Level
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
1 week 19 hours
Scan only one
Domain, Subdomain, IPv4
Toolbox
-
The Invision Community platform, a popular community management and forum solution, suffers from a critical security flaw in versions 5.0.0 through 5.0.6 that allows unauthenticated Remote Code Execution (RCE). Identified as CVE-2025-47916, this vulnerability stems from a flaw in the themeeditor controller (/applications/core/modules/front/system/themeeditor.php).
The protected customCss method within this controller is accessible to unauthenticated users and processes the content parameter using Theme::makeProcessFunction(). This method dangerously evaluates user-controlled input in the templating engine, enabling attackers to execute arbitrary PHP code.
A successful exploit can fully compromise the server, exfiltrate sensitive data, or pivot to other systems. The issue is patched in version 5.0.7.
REFERENCES
