CVE-2025-71281: XenForo Template Method Call Restriction Bypass
XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, potentially allowing unauthorized method invocations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71281?
CVE-2025-71281 is considered a moderate severity vulnerability that could allow for unauthorized method calls in templates.
How do I fix CVE-2025-71281?
To fix CVE-2025-71281, upgrade XenForo to version 2.3.7 or later where the vulnerability has been addressed.
What types of exploits are possible with CVE-2025-71281?
CVE-2025-71281 allows attackers to execute unauthorized methods through template callbacks, potentially leading to remote code execution.
Which versions of XenForo are affected by CVE-2025-71281?
XenForo versions prior to 2.3.7 are vulnerable to CVE-2025-71281.
Is CVE-2025-71281 publicly disclosed?
Yes, CVE-2025-71281 has been publicly disclosed and is documented in security advisories.