CVE-2025-71281

HighPublic PoCRCE

Published: 01 April 2026

Published

01 April 2026

Modified

01 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0033 24.9th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-71281 is a high-severity Code Injection (CWE-94) vulnerability in Xenforo Xenforo. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-71281 is a code injection vulnerability (CWE-94) affecting XenForo forum software versions prior to 2.3.7. The issue arises from improper restriction of methods callable from within templates, where a loose prefix match is used instead of a stricter first-word match for methods accessible through callbacks and variable method calls. This flaw enables potential unauthorized method invocations, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An attacker with low-privilege access, such as an authenticated user on a vulnerable XenForo instance, can exploit this over the network with low complexity and no user interaction required. Successful exploitation allows high-impact consequences, including unauthorized access to sensitive data (C:H), modification of system integrity (I:H), and disruption of availability (A:H), potentially leading to remote code execution or other severe compromises via arbitrary method calls.

Advisories from VulnCheck detail the template method call restriction bypass, while XenForo's official release notes for version 2.3.7 confirm it addresses this and other security fixes, recommending immediate upgrades to mitigate the vulnerability.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-209156

Vulnerability details

XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, potentially allowing unauthorized method invocations.

CWE(s): CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Direct code injection in public-facing web app (XenForo) enables T1190 exploitation leading to RCE via arbitrary method calls; execution occurs through the application's scripting interpreter (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0