CVE-2025-47916
Description
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: >=5.0.0, <5.0.7
- Range: 5.0.0
Patches
Vulnerability mechanics
Root cause
"The protected method customCss() passes unsanitized user input from the "content" request parameter directly to Theme::makeProcessFunction(), which evaluates it as template code, enabling arbitrary PHP code execution."
Attack vector
An unauthenticated attacker sends a crafted HTTP request to the themeeditor.php endpoint, invoking the customCss() method [ref_id=1]. The attacker supplies a malicious template string in the "content" parameter, which is passed to Theme::makeProcessFunction() at line 368 of /applications/core/modules/front/system/themeeditor.php [ref_id=1]. Because the template engine evaluates the input, the attacker can inject arbitrary PHP code that executes on the server. No authentication or prior access is required, making this a remotely exploitable unauthenticated RCE [ref_id=1].
Affected code
The vulnerability is located in /applications/core/modules/front/system/themeeditor.php, specifically in the IPS\core\modules\front\system\themeeditor::customCss() method at line 365-376 [ref_id=1]. The critical line is 368, where the unsanitized "content" request parameter is passed to Theme::makeProcessFunction() [ref_id=1].
What the fix does
The advisory states that the solution is to upgrade to Invision Community version 5.0.7 or later [ref_id=1]. No patch diff is provided in the bundle, but the vendor released version 5.0.7 on 12 May 2025 to address this issue [ref_id=1]. The fix presumably restricts access to the customCss() method to authenticated users only, or sanitizes/validates the input before passing it to the template engine, preventing unauthenticated template code evaluation.
Preconditions
- authNo authentication required — the customCss() method is protected but can be invoked by unauthenticated users
- networkNetwork access to the Invision Community web application
- inputAttacker must supply a crafted template string in the 'content' request parameter
Reproduction
A proof of concept is available at https://karmainsecurity.com/pocs/CVE-2025-47916.php [ref_id=1]. The reproduction steps involve sending a crafted HTTP request to the themeeditor.php endpoint with a malicious template string in the "content" parameter to trigger arbitrary PHP code execution via the template engine.
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.