What is the CVSS score of CVE-2026-39387?

CVE-2026-39387 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-39387?

BoidCMS versions prior to 2.1.3 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary PHP code through path traversal and file upload chaining.

How to fix or mitigate CVE-2026-39387?

Within 24 hours: Audit all BoidCMS installations and identify versions prior to 2.1.3; restrict administrative access to trusted personnel only. Within 7 days: Upgrade all affected BoidCMS instances to version 2.1.3 or later; validate upgrade completion and test administrative functionality. Within 30 days: Conduct access reviews of all administrator accounts created or modified in the past 90 days; implement audit logging for file uploads and PHP execution events.

PHP CVE-2026-39387

HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-14 security-advisories@github.com

RCE LFI PHP File Upload Path Traversal

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 01:12 vuln.today

Analysis Generated

Apr 14, 2026 - 23:22 vuln.today

CVE Published

Apr 14, 2026 - 23:16 nvd

HIGH 7.2

DescriptionGitHub Advisory

BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to Remote Code Execution (RCE).The application fails to sanitize the tpl (template) parameter during page creation and updates. This parameter is passed directly to a require_once() statement without path validation. An authenticated administrator can exploit this by injecting path traversal sequences (../) into the tpl value to escape the intended theme directory and include arbitrary files - specifically, files from the server's media/ directory. When combined with the file upload functionality, this becomes a full RCE chain: an attacker can first upload a file with embedded PHP code (e.g., disguised as image data), then use the path traversal vulnerability to include that file via require_once(), executing the embedded code with web server privileges. This issue has been fixed in version 2.1.3.

AnalysisAI

Local File Inclusion in BoidCMS versions prior to 2.1.3 enables authenticated administrators to execute arbitrary PHP code via path traversal in the tpl parameter combined with file upload. The vulnerability chains unsanitized require_once() inclusion with media upload functionality, allowing attackers to upload malicious files and force their execution with web server privileges. Vendor-released patch available in version 2.1.3. CVSS 7.2 reflects high-privilege requirement (administrator access), but exploitation complexity is low once authenticated. No CISA KEV listing or public exploit code identified at time of analysis.

Technical ContextAI

BoidCMS is a flat-file content management system written in PHP that uses JSON for data persistence rather than traditional databases. The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a class of injection flaws where user-controlled input flows directly into file inclusion functions. The application's page creation and update functionality accepts a tpl (template) parameter intended to specify theme files, but passes this value unsanitized to PHP's require_once() statement. Without path canonicalization or whitelist validation, attackers can inject directory traversal sequences (../) to escape the intended /themes/ directory scope. PHP's require_once() executes any included file as code, so traversing to the /media/ upload directory and including a file containing embedded PHP transforms a path traversal vulnerability into remote code execution. This attack pattern is particularly dangerous in flat-file CMS architectures where upload directories and executable content share the same filesystem hierarchy without isolation.

RemediationAI

Upgrade immediately to BoidCMS version 2.1.3, which contains input validation fixes that prevent path traversal in the tpl parameter. The patched version is available from the official GitHub releases page at https://github.com/BoidCMS/BoidCMS/releases/tag/v2.1.3. Review the security advisory at https://github.com/BoidCMS/BoidCMS/security/advisories/GHSA-45xp-xw54-6cv6 for additional context. After upgrading, audit existing page configurations for suspicious tpl values containing traversal sequences and review media upload directories for files with embedded PHP code uploaded by admin accounts. As a temporary mitigation for environments where immediate patching is not feasible, restrict administrator account access to only trusted personnel, implement web application firewall rules to block requests containing directory traversal patterns in the tpl parameter, and consider filesystem-level restrictions preventing the web server from executing files in the media upload directory.