Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPScoremodulesadmineditor_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the applications/core/interface/ckeditor/ckeditor/plugins/ directory without properly verifying their content. This can be exploited by admin users (with the toolbar_manage permission) to write arbitrary PHP files into that directory, leading to execution of arbitrary PHP code in the context of the web server user.
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.