CVE-2025-47916

CVE-2025-47916 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in the theme editor of Invision Community 5.0.x. The themeeditor controller (/applications/core/modules/front/system/themeeditor.php) exposes a protected customCss method to unauthenticated users, and this method passes the 'content' request parameter into Theme::makeProcessFunction(), where it is evaluated by the template engine. By sending crafted template strings to themeeditor.php, an attacker can inject and execute arbitrary PHP code with the privileges of the web server, with no account, privileges, or user interaction required. Any installation running Invision Community 5.0.0 up to but not including 5.0.7 is affected. A public proof of concept is available (KIS-2025-02) and EPSS assigns an 83.7% probability of exploitation within 30 days, though the flaw is not yet in CISA KEV and no confirmed in-the-wild exploitation is reported.

What to do: Upgrade to Invision Community 5.0.7 or later immediately. Until patched, restrict or block unauthenticated access to /applications/core/modules/front/system/themeeditor.php, and review web server logs for requests to themeeditor.php with unexpected or unusually long 'content' parameter values. Given the public PoC and near-maximal EPSS score, internet-facing forums running 5.0.0–5.0.6 should treat this as an urgent patch priority.