CVE-2025-47916·PHP vulnerability

Affected versions

How to fix this CVE

Update PHP and Invision Community to version 5.0.7 or later immediately. This critical vulnerability allows unauthenticated attackers to execute arbitrary PHP code through template injection in the theme editor. Apply the patch as soon as possible, as public exploits are available and the attack requires no authentication or user interaction.

sudo dnf update php

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET /index\.php.*module=system&controller=themeeditor.*customCss.*\{\{\{.*\}\}\}

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Block or rate-limit requests to /index.php with module=system and controller=themeeditor parameters. Filter request bodies containing template injection patterns like `{{{` or `}}}` in POST data. Implement IP-based rate limiting on the themeeditor endpoint to prevent automated exploitation attempts.

How to check if you are affected

1. Step 1: Run `php -v` to verify your current PHP version and confirm if Invision Community 5.0.0-5.0.6 is installed.
2. Step 2: Check if the vulnerable file exists at /applications/core/modules/front/system/themeeditor.php and inspect its permissions using `ls -la /path/to/invision/applications/core/modules/front/system/themeeditor.php`.
3. Step 3: Search web server access logs for POST/GET requests to themeeditor.php with crafted template syntax (e.g., strings containing `{{{` or `}}}`) using `grep -i 'themeeditor.php' /var/log/apache2/access.log | grep -E '\{\{\{|\}\}\}'`.
4. Step 4: Verify the patch by checking the Invision Community version in the admin panel or by inspecting /system/Version.php for version >= 5.0.7.

Indicators of compromise

• POST requests to themeeditor.php with crafted template strings containing {{{ or }}}
• Access logs showing unusual customCss parameter values with PHP syntax
• HTTP 200 responses from themeeditor.php endpoints before authentication gate

FAQ

Related PHP CVEs

References

• https://invisioncommunity.com/release-notes-v5/507-r41/
• https://karmainsecurity.com/KIS-2025-02
• http://seclists.org/fulldisclosure/2025/May/4
• https://karmainsecurity.com/KIS-2025-02