Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to Remote Code Execution (RCE).The application fails to sanitize the tpl (template) parameter during page creation and updates. This parameter is passed directly to a require_once() statement without path validation. An authenticated administrator can exploit this by injecting path traversal sequences (../) into the tpl value to escape the intended theme directory and include arbitrary files — specifically, files from the server's media/ directory. When combined with the file upload functionality, this becomes a full RCE chain: an attacker can first upload a file with embedded PHP code (e.g., disguised as image data), then use the path traversal vulnerability to include that file via require_once(), executing the embedded code with web server privileges. This issue has been fixed in version 2.1.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-14 | 1 | General1 |
| 2026-04-15 | 3 | Disclosure3 |
CVE-2026-39387 BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a cri… https://www.cve.org/CVERecord?id=CVE-2026-39387
Post summary
The text announces that BoidCMS versions before 2.1.3 are vulnerable to CVE‑2026‑39387, but it offers no proof‑of‑concept, exploit details, or patch information.
CVE-2026-39387: BoidCMS Template Parameter Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04cb9c00
Post summary
A short article headline announcing the BoidCMS Template Parameter Bug (CVE‑2026‑39387) and encouraging readers to respond, but without providing technical, exploit, or patch details.
CVE-2026-39387 Local File Inclusion and Remote Code Execution in BoidCMS Versions Prior to 2.1.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39387
Post summary
The text announces the existence of CVE-2026-39387, detailing an LFI and RCE vulnerability in BoidCMS versions before 2.1.3, without mentioning PoC, exploitation, or mitigation.
⚠️ HIGH — CVE-2026-39387 BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. … CVSS 7.2 Full analysis → https://sec.kaitan.id/cves/CVE-2026-39387 #HP #CyberSecurity #InfoSec
Post summary
The post announces a high severity CVE for BoidCMS with a CVSS score of 7.2 and provides a link to further analysis, but offers no additional technical or actionable details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | boidcms | boidcms | - | - | - |