Loading vulnerability…
XenForo template method call restriction bypass
CVE-2025-71281 affects XenForo before 2.3.7. The vulnerability is caused by improper restriction of methods callable from within templates: XenForo used a loose prefix match rather than a stricter first-word match when determining which methods were accessible through template callbacks and variable method calls. As a result, an attacker with the ability to reach the vulnerable template invocation path could potentially trigger unauthorized method invocations that should have been blocked by the template method restrictions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow unauthorized invocation of application methods from XenForo templates. Based on the provided severity metadata, the impact may extend to compromise of confidentiality, integrity, and availability, depending on which methods become reachable in the target deployment and what those methods do.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting who can create or modify templates or otherwise influence template callbacks and variable method calls, reviewing customizations that rely on dynamic template method invocation, and monitoring for unexpected template-driven method execution. These are partial mitigations; upgrading to 2.3.7 or later is the definitive fix.
Patch, then assume compromise.
Upgrade XenForo to version 2.3.7 or later, which includes the security fix referenced in the XenForo 2.3.7 release. The fix tightens method matching from a loose prefix-based check to a stricter first-word match for methods accessible via template callbacks and variable method calls.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.