CVE-2025-71281

HighPublic PoCRCE

Published: 01 April 2026

Published

01 April 2026

Modified

01 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0006 18.9th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-71281 is a high-severity Code Injection (CWE-94) vulnerability in Xenforo Xenforo. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Timely installation of the XenForo 2.3.7 patch directly remediates the improper loose prefix matching for template method calls.

SI-10 Information Input Validation good match

prevent

Validates method names in template callbacks and variable calls to enforce strict first-word matching, preventing unauthorized invocations.

AC-3 Access Enforcement good match

prevent

Enforces approved access authorizations for methods accessible via XenForo templates, addressing the loose restriction bypass.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Direct code injection in public-facing web app (XenForo) enables T1190 exploitation leading to RCE via arbitrary method calls; execution occurs through the application's scripting interpreter (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, potentially allowing unauthorized method invocations.

Deeper analysisAI

CVE-2025-71281 is a code injection vulnerability (CWE-94) affecting XenForo forum software versions prior to 2.3.7. The issue arises from improper restriction of methods callable from within templates, where a loose prefix match is used instead of a stricter first-word match for methods accessible through callbacks and variable method calls. This flaw enables potential unauthorized method invocations, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An attacker with low-privilege access, such as an authenticated user on a vulnerable XenForo instance, can exploit this over the network with low complexity and no user interaction required. Successful exploitation allows high-impact consequences, including unauthorized access to sensitive data (C:H), modification of system integrity (I:H), and disruption of availability (A:H), potentially leading to remote code execution or other severe compromises via arbitrary method calls.

Advisories from VulnCheck detail the template method call restriction bypass, while XenForo's official release notes for version 2.3.7 confirm it addresses this and other security fixes, recommending immediate upgrades to mitigate the vulnerability.