CVE-2025-47916: Invision Community themeeditor.php unauthenticated PHP code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS of 9.8 and very high EPSS, with public exploit detail referenced.

What it is

Invision Community 5.0.0 before 5.0.7 exposes the themeeditor controller's protected customCss method to unauthenticated users, and the content parameter is passed into Theme::makeProcessFunction() where it is evaluated by the template engine. This lets an attacker inject crafted template strings that execute arbitrary PHP code. Because it is remotely reachable without credentials, it is a severe pre-auth RCE risk for any unpatched board.

Impact

An unauthenticated attacker can execute arbitrary PHP code on the server, leading to full compromise of the Invision Community instance and potentially the underlying host. That includes data theft, webshell placement, and lateral movement.

Attack surface

Reached over the network via themeeditor.php in the core front system module; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. The flaw is in the customCss method invoked through the content parameter.

Exploitation

Not listed in CISA KEV, but EPSS is 0.83732 (99.674th percentile) and references include an Exploit-tagged advisory (Karmain Security KIS-2025-02) plus a Full Disclosure post, indicating public exploit detail is available.

What to do

• Upgrade Invision Community to 5.0.7 or later immediately; this is the only complete fix.
• If patching cannot be done at once, block or restrict external access to themeeditor.php at the web server or WAF.
• Restrict outbound and inbound access to the Invision Community application to trusted networks where feasible.
• After patching, rotate secrets and review for unauthorized admin accounts, modified templates, or dropped PHP files.
• Monitor vendor release notes for any further guidance on the 5.0.7 fix.

Detection

• Search web logs for requests to /applications/core/modules/front/system/themeeditor.php, especially with a content parameter, from unauthenticated or unexpected sources.
• Look for POST requests to themeeditor.php returning 200 with unusual or encoded template/PHP-like payloads in the request body.
• Hunt for newly created or modified PHP files in web-accessible directories and unexpected child processes spawned by the web server user.
• Review Invision Community logs and file integrity monitoring for template or theme changes made outside normal administrative activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.