PT-2026-32961 · Boidcms · Boidcms

Ckwo · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-39387

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BoidCMS versions prior to 2.1.3

Description An issue exists where the application fails to sanitize the tpl parameter during page creation and updates. This parameter is passed directly to the require once() function without path validation. An authenticated administrator can use path traversal sequences to escape the theme directory and include arbitrary files from the server's media directory. By uploading a file containing PHP code and including it via the tpl parameter, an attacker can achieve Remote Code Execution (RCE), which is the ability to execute arbitrary commands on the host server.

Recommendations Update to version 2.1.3. As a temporary workaround, restrict access to the tpl parameter during page creation and updates until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-39387

Affected Products

Boidcms

References · 5

• 🔥 https://github.com/BoidCMS/BoidCMS/security/advisories/GHSA-45xp-xw54-6cv6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39387 · Security Note
• https://github.com/BoidCMS/BoidCMS/releases/tag/v2.1.3 · Note
• https://twitter.com/integ_sec/status/2044453293712195706 · Twitter Post
• https://twitter.com/CVEnew/status/2044338887678636376 · Twitter Post