CVE-2025-71281

Description

XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, potentially allowing unauthorized method invocations.

CVSS Vector

Affected Products

References

• https://www.vulncheck.com/advisories/xenforo-template-method-call-restriction-bypass
• https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121/