CVE-2025-47916 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected Versions**: Invision Community **5.0.0 through 5.0.6** (specifically before 5.0.7). 🎯 **Component**: The `themeeditor` controller (`/applications/core/modules/front/system/themeeditor.php`).

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Exploitation Threshold**: **LOW**. ⚡ **Auth**: None required (Unauthenticated). 🌐 **Access**: Network accessible (AV:N). 🎯 **Complexity**: Low (AC:L). No user interaction needed (UI:N).

Q: Is there a public Exp? (PoC/Wild Exploitation)

💻 **Public Exploit**: **YES**. 📂 PoCs are available on GitHub (e.g., ProjectDiscovery Nuclei templates, Web3-Serializer repo). Wild exploitation is likely given the low barrier to entry.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **YES**. Update to **Invision Community 5.0.7** or later. 📝 Reference: Invision Community Release Notes v5/507-r41. This patch addresses the unsafe template processing in `customCss()`.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 CVSS Score is **9.8** (Critical). Unauthenticated RCE is a top-priority threat. Immediate patching to v5.0.7+ is strongly recommended to prevent total server compromise.

Updated May 08, 2026 CVSS 10.0 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Invision Community suffers from **Remote Code Execution (RCE)** via unsafe template strings.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-1336** (Improper Neutralization of Special Elements used in a Template Engine).…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected Versions**: Invision Community **5.0.0 through 5.0.6** (specifically before 5.0.7). 🎯 **Component**: The `themeeditor` controller (`/applications/core/modules/front/system/themeeditor.php`).

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Capabilities**: Unauthenticated users can execute **arbitrary PHP code**. This grants **High** impact on Confidentiality, Integrity, and Availability.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Exploitation Threshold**: **LOW**. ⚡ **Auth**: None required (Unauthenticated). 🌐 **Access**: Network accessible (AV:N). 🎯 **Complexity**: Low (AC:L). No user interaction needed (UI:N).

Q6Is there a public Exp? (PoC/Wild Exploitation)

💻 **Public Exploit**: **YES**. 📂 PoCs are available on GitHub (e.g., ProjectDiscovery Nuclei templates, Web3-Serializer repo). Wild exploitation is likely given the low barrier to entry.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for `/applications/core/modules/front/system/themeeditor.php`. Use Nuclei templates for CVE-2025-47916. Check if the site runs Invision Community v5.0.0-5.0.6.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **YES**. Update to **Invision Community 5.0.7** or later. 📝 Reference: Invision Community Release Notes v5/507-r41. This patch addresses the unsafe template processing in `customCss()`.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: Disable the `themeeditor` module if possible. Restrict access to `/applications/core/modules/front/system/themeeditor.php` via WAF or firewall rules.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 CVSS Score is **9.8** (Critical). Unauthenticated RCE is a top-priority threat. Immediate patching to v5.0.7+ is strongly recommended to prevent total server compromise.

Continue exploring

Vulnerability detail Full AI analysis (login) invisioncommunity CWE-1336