CVE-2025-71281 PUBLISHED

XenForo Template Method Call Restriction Bypass

Assigner: VulnCheck
Reserved: 01.04.2026 Published: 01.04.2026 Updated: 01.04.2026

XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, potentially allowing unauthorized method invocations.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor XenForo
Product XenForo
Versions
  • affected from 2.3.0 to 2.3.7 (excl.)

Credits

  • Cyanide finder

References

Problem Types

  • Improper Control of Generation of Code ('Code Injection') CWE