CVE-2026-39387
Published: 14 April 2026
Summary
CVE-2026-39387 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Boidcms Boidcms. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-39387 is a critical Local File Inclusion (LFI) vulnerability in BoidCMS, an open-source PHP-based flat-file content management system that uses JSON as its database. Versions prior to 2.1.3 fail to sanitize the "tpl" template parameter during page creation and updates, passing it directly to a require_once() statement without path validation. This allows attackers to inject path traversal sequences, such as "../", to escape the intended theme directory and include arbitrary files, particularly from the server's media/ directory. The flaw is classified under CWE-98 and carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
An authenticated administrator can exploit this vulnerability to achieve remote code execution (RCE). The attack chain begins with uploading a malicious file containing embedded PHP code, disguised as an image via the file upload functionality. The attacker then manipulates the "tpl" parameter with path traversal to include the uploaded file through require_once(), executing the PHP code with web server privileges.
The vulnerability has been addressed in BoidCMS version 2.1.3. Administrators are advised to upgrade immediately to mitigate the issue. Official details are provided in the GitHub security advisory GHSA-45xp-xw54-6cv6 and the release notes for tag v2.1.3.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22804
Vulnerability details
BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to…
more
Remote Code Execution (RCE).The application fails to sanitize the tpl (template) parameter during page creation and updates. This parameter is passed directly to a require_once() statement without path validation. An authenticated administrator can exploit this by injecting path traversal sequences (../) into the tpl value to escape the intended theme directory and include arbitrary files — specifically, files from the server's media/ directory. When combined with the file upload functionality, this becomes a full RCE chain: an attacker can first upload a file with embedded PHP code (e.g., disguised as image data), then use the path traversal vulnerability to include that file via require_once(), executing the embedded code with web server privileges. This issue has been fixed in version 2.1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI with path traversal in public-facing PHP web app enables RCE by including/executing uploaded malicious PHP code, directly mapping to exploitation of public-facing applications and web shell deployment.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of the tpl parameter to block path traversal sequences that enable LFI and subsequent RCE via arbitrary file inclusion.
Mandates timely flaw remediation by upgrading BoidCMS to version 2.1.3, which fixes the unsanitized tpl parameter vulnerability.
Enforces logical access controls to restrict require_once() to authorized template paths within the theme directory, preventing inclusion of arbitrary files like uploaded malicious media.