CVE-2026-39387

HighCVSS 7.2

Published: 14/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.73%

51th percentile - higher than 51% of all known CVEs

Summary

BoidCMS versions prior to 2.1.3 contain a critical Local File Inclusion (LFI) vulnerability via the tpl parameter. This parameter is passed to require_once() without path validation. An authenticated administrator can use ../ sequences to include arbitrary files, including files from the media/ directory. Combined with file upload functionality, this allows Remote Code Execution (RCE).

Risk Assessment

An authenticated administrator can upload a file with PHP code (e.g., disguised as an image) and then include it via LFI, leading to code execution with web server privileges. This can result in full site compromise.

Recommendation

Update BoidCMS to version 2.1.3 or later. If an update is not possible, restrict administrator privileges and monitor uploaded files.

Other vulnerabilities in BoidCMS

CVE-2023-38836High
File upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.

Original NVD description (English source)

BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to Remote Code Execution (RCE).The application fails to sanitize the tpl (template) parameter during page creation and updates. This parameter is passed directly to a require_once() statement without path validation. An authenticated administrator can exploit this by injecting path traversal sequences (../) into the tpl value to escape the intended theme directory and include arbitrary files — specifically, files from the server's media/ directory. When combined with the file upload functionality, this becomes a full RCE chain: an attacker can first upload a file with embedded PHP code (e.g., disguised as image data), then use the path traversal vulnerability to include that file via require_once(), executing the embedded code with web server privileges. This issue has been fixed in version 2.1.3.