CVE-2025-47916

What it actually does

This vulnerability is an unauthenticated remote code execution flaw in Invision Community 5.0.0 through 5.0.6. The vulnerable theme editor controller exposes a protected customCss method that can be invoked remotely without authentication. That method passes the user-controlled content parameter into the Invision template processing path via Theme::makeProcessFunction(), causing crafted template strings to be evaluated by the PHP template engine. Successful exploitation allows an attacker to execute arbitrary PHP code in the context of the web server process, potentially leading to web shell deployment, credential theft, database access, file modification, and full application compromise.

Why it matters to the business

A public-facing Invision Community instance running a vulnerable version can be taken over remotely without valid credentials. Because the exploit is weaponized and has a high EPSS score, internet-exposed systems should be treated as high-priority remediation targets. Compromise may result in forum defacement, theft of user data, administrator account takeover, malware or spam distribution through the community platform, service disruption, reputational damage, and regulatory exposure if personal data is accessed.

How an attack unfolds

An attacker first identifies an internet-accessible Invision Community 5 instance and determines whether it is running a vulnerable 5.0.x release before 5.0.7. The attacker then sends a crafted HTTP request to the theme editor functionality, targeting the themeeditor.php controller or its routed endpoint. The request invokes the customCss behavior and supplies a malicious content parameter containing template syntax designed to be processed as executable PHP logic. Because the vulnerable code passes that value into Theme::makeProcessFunction(), the template engine evaluates the attacker-controlled string. If successful, the attacker gains code execution as the web server user. From there, the attacker may write a PHP web shell, run operating system commands, read configuration files, extract database credentials, access user data, create persistence, or pivot further into the hosting environment.

How to fix it

Upgrade Invision Community to version 5.0.7 or later immediately. If immediate upgrade is not possible, restrict public access to the theme editor route, block unauthenticated access to themeeditor.php and related system/themeeditor paths at the web application firewall or reverse proxy, and limit administrative/theme-editing functionality to trusted IP ranges. Review file permissions so the web server user cannot write to unnecessary directories. Rotate application secrets, administrator passwords, and database credentials if exploitation is suspected. Remove any unauthorized PHP files, modified templates, scheduled tasks, or persistence mechanisms discovered during investigation.

How to confirm the fix worked

Confirm that the running Invision Community version is 5.0.7 or later from the application administrator interface, release files, or package metadata. Verify that unauthenticated requests to the theme editor endpoint are denied or no longer invoke template processing. Review reverse proxy, web server, and application logs for requests to themeeditor.php, system/themeeditor routes, or requests containing a content parameter with suspicious template or PHP execution syntax. Where safe and authorized, perform a non-executing validation request to confirm the vulnerable route is not reachable anonymously. Validate file integrity against a known-good release and confirm no unexpected PHP files exist in writable web directories.

Typical attack path

1. Scan for publicly reachable Invision Community 5 installations.
2. Fingerprint the application version or infer vulnerability from exposed assets and behavior.
3. Send a crafted unauthenticated HTTP request to the theme editor route or themeeditor.php controller.
4. Place malicious template syntax in the content parameter.
5. Trigger server-side template processing through Theme::makeProcessFunction().
6. Execute arbitrary PHP code under the web server process account.
7. Deploy a web shell or run commands for persistence and post-exploitation.
8. Read application configuration, steal database credentials, access user data, or modify site content.

How to detect it

Investigate web server access logs, reverse proxy logs, WAF events, PHP-FPM logs, application logs, file integrity monitoring, endpoint telemetry, and outbound network telemetry. Focus on unauthenticated requests to themeeditor.php or routed system/themeeditor endpoints, especially POST requests containing a content parameter. Look for template-expression syntax, PHP function names, shell command strings, encoded payloads, or attempts to write PHP files. Review timestamps around suspicious requests for new or modified files in the web root, uploads, cache, datastore, theme, plugin, or temporary directories. Check for PHP processes spawning shell utilities such as sh, bash, curl, wget, nc, python, perl, or php child processes. Inspect application configuration access, database export activity, administrator account changes, newly installed plugins, altered theme templates, and unexpected outbound connections from the web server. Because exploitation is weaponized, absence of a KEV listing should not be treated as low risk.

• /applications/core/modules/front/system/themeeditor.php
• themeeditor.php
• /system/themeeditor
• content=
• Theme::makeProcessFunction
• customCss
• POST *themeeditor*
• GET *themeeditor*
• content=%7B
• content={{
• content={expression
• <?php
• system(
• shell_exec(
• passthru(
• exec(
• proc_open(
• popen(
• base64_decode(
• eval(
• assert(
• file_put_contents(
• fwrite(
• curl
• wget
• /bin/sh
• /bin/bash
• cmd=
• whoami
• id;
• uname -a
• php -r
• nc -e
• bash -i
• python -c
• perl -e
• .php?cmd=
• uploads/*.php
• datastore/*.php
• plugins/*.php
• themes/*.php
• cache/*.php

What your security team should do

• Treat exposed Invision Community 5.0.0 through 5.0.6 systems as urgent due to weaponized exploitation and a high EPSS score.
• Upgrade all affected instances to Invision Community 5.0.7 or later.
• Place temporary WAF or reverse proxy controls blocking unauthenticated access to themeeditor.php and system/themeeditor routes until patching is complete.
• Hunt for exploitation before patching is assumed successful, especially on internet-facing systems.
• Search for newly created or recently modified PHP files in web-accessible writable directories.
• Review web server logs for suspicious content parameter usage, template payloads, command execution strings, and requests to theme editor endpoints.
• Rotate administrator credentials, database credentials, API keys, and application secrets if suspicious activity is found.
• Perform post-remediation integrity checks of application files, themes, plugins, and templates.
• Monitor for outbound connections from the web server to unusual IPs or ports that may indicate reverse shells or malware staging.