CVE-2025-47916 is a critical remote code execution flaw (CVSS 10.0) in Invision Community versions 5.0.0 through 5.0.6. An unauthenticated visitor can reach a theme editor method that evaluates template strings. Version 5.0.7 fixes it, so upgrade to 5.0.7 or later.
What's affected
The record says Invision Community 5.0.0 before 5.0.7 is affected. The researcher's write up on Karma(In)Security gives the same range, all versions from 5.0.0 to 5.0.6, and recommends upgrading to 5.0.7 or later. It lists 5.0.7 as released on 12 May 2025. Invision's release notes for 5.0.7 are the vendor reference, though their page would not load for me, so I rely on the other two sources for the version.
The score is the maximum, 10.0. The vector shows network access, low complexity, no privileges, no user interaction and a changed scope, with high impact on confidentiality, integrity and availability. The flaw is not in the CISA Known Exploited Vulnerabilities catalog, according to the record.
The record does not mark it as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Find your Invision Community version in the admin control panel, where the version appears on the dashboard. If your community is hosted by Invision, the vendor manages upgrades, so confirm the version with them. Self hosted installs should be at 5.0.7 or later. Versions in the 4.x line are outside the range in the record.
Then check your access logs for requests to the theme editor controller path, which the write up places under the front system module. Requests from unknown addresses are worth a closer look, especially before you patched. A single log line is not proof of compromise, but unexpected requests there are a reason to investigate.
What to do now
- Upgrade Invision Community to 5.0.7 or later.
- If you cannot upgrade today, block or restrict access to the theme editor path at the web server or firewall as a temporary measure and test that the site still works.
- Review access logs for unusual requests to the theme editor controller.
- Check for new or changed files in the web root and for new administrator accounts.
- If you see signs of misuse, treat the server as compromised: rebuild from a known good backup and rotate credentials and keys.
- Subscribe to the vendor's release notes so you see future security fixes quickly.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record lists CWE-94, code injection, and CWE-1336, improper neutralization of special elements in a template engine. The write up explains that a protected method named customCss can still be invoked by unauthenticated users, and that it passes a request parameter to the template engine. Template engines run their own small programs, so letting a visitor supply template text means letting a visitor supply code.
The fix is to require authentication and permission checks on every controller action that changes or evaluates themes, and never to hand user input to the template compiler. For you, the fix is the upgrade. Because the flaw needs no login, any internet facing install on the affected range should be treated as urgent.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions are affected by CVE-2025-47916?
Invision Community 5.0.0 through 5.0.6. Version 5.0.7 fixes it.
Does the attacker need an account?
No. The record and the researcher's write up describe the flaw as reachable by unauthenticated users.
Sources
- Gold page for CVE-2025-47916
- Karma(In)Security write up KIS-2025-02
- Invision Community 5.0.7 release notes (listed in the CVE record)
Last reviewed: 18 October 2026.
