CVE Explorer

CVE-2026-39387

BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to Remote Code Execution (RCE).The application fails to sanitize the tpl (template) parameter during page creation and updates. This parameter is passed directly to a require_once() statement without path validation. An authenticated administrator can expl

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:ca9cf3ca3259694f7eb8432ca5feddc832c710b4dad30162b61001606e5459f8

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"BoidCMS","vendor":"BoidCMS","versions":[{"status":"affected","version":"< 2.1.3"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:d0b78018e926576b219ef780c2f0627a7d3a2be82e3f95f37724b4b8065aadeb · sha256:86329546c4fdf44e… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:d0b78018e926576b219ef780c2f0627a7d3a2be82e3f95f37724b4b8065aadeb · sha256:86329546c4fdf44e… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-98","description":"CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:d0b78018e926576b219ef780c2f0627a7d3a2be82e3f95f37724b4b8065aadeb · sha256:86329546c4fdf44e… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions

{"name":"https://github.com/BoidCMS/BoidCMS/releases/tag/v2.1.3","tags":["x_refsource_MISC"],"url":"https://github.com/BoidCMS/BoidCMS/releases/tag/v2.1.3"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:d0b78018e926576b219ef780c2f0627a7d3a2be82e3f95f37724b4b8065aadeb · sha256:86329546c4fdf44e… · /containers/cna/references/1

{"name":"https://github.com/BoidCMS/BoidCMS/security/advisories/GHSA-45xp-xw54-6cv6","tags":["x_refsource_CONFIRM"],"url":"https://github.com/BoidCMS/BoidCMS/security/advisories/GHSA-45xp-xw54-6cv6"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:d0b78018e926576b219ef780c2f0627a7d3a2be82e3f95f37724b4b8065aadeb · sha256:86329546c4fdf44e… · /containers/cna/references/0

{"tags":["exploit"],"url":"https://github.com/BoidCMS/BoidCMS/security/advisories/GHSA-45xp-xw54-6cv6"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:d0b78018e926576b219ef780c2f0627a7d3a2be82e3f95f37724b4b8065aadeb · sha256:86329546c4fdf44e… · /containers/adp/0/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer