CVE-2025-71281 is a high severity (CVSS 8.8) flaw in XenForo before 2.3.7. Template callbacks and variable method calls used a loose prefix match, which could allow methods that should be blocked to run. The fix is XenForo 2.3.7 or later, so upgrade and review any custom templates.
What's affected
XenForo before 2.3.7, per the record. The XenForo 2.3.7 release announcement, which the record links, includes security fixes. Version 2.3.7 or later is the target.
How to check if you're exposed
- Sign in to the admin control panel and read the installed version on the dashboard.
- If it is earlier than 2.3.7, plan the upgrade.
- List who has rights to edit templates or styles, since the CVSS vector requires a low privilege account.
What to do now
- Back up the database and files.
- Upgrade XenForo to 2.3.7 or later using the official upgrade process.
- Review which accounts can edit templates, styles and add-ons, and remove rights that are not needed.
- Check custom templates and add-ons for dynamic method calls that you do not recognise.
- Re-run your add-on compatibility checks after the upgrade.
Template engines give site builders a lot of power, and the safe design is an allow list of what a template may call. This CVE shows how a small matching error in such a list turns it into a wider door than intended.
When you upgrade, test your forum on a staging copy first, particularly custom styles and add-ons that use template callbacks. Fixes that tighten an allow list can break templates that relied on the looser rule, and it is better to find that before your members do.
Keep a short list of who can edit templates and who can install add-ons. Those rights are close to administrative power in any system with a template engine, so grant them narrowly.
Why it matters
The record puts this under CWE-94 (code injection). Templates let site builders call methods through callbacks and variable method calls. The allow list used a loose prefix match rather than a strict match on the first word, so more methods could be called than intended.
It is a good example of an allow list that is almost right. The record says nothing about exploitation, and it is not in the CISA KEV list.
Quick check
Does a visitor with no account trigger this?
The vector shows low privileges required, so an account with some rights is expected. The record does not give exploitation steps and neither do we.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Also referenced by the CVE record:
Last reviewed: 19 October 2026.
