Bootstrap CMS CVE-2026-7508

Q: What is the CVSS score of CVE-2026-7508?

CVE-2026-7508 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-30 cna@vuldb.com

PHP Code Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 23:30 vuln.today

Analysis Generated

Apr 30, 2026 - 23:22 vuln.today

CVE Published

Apr 30, 2026 - 23:16 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The code repository of the project has not been active for many years. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Code injection in Bootstrap CMS 0.9.0-alpha page creation handler allows authenticated remote attackers to inject arbitrary code via the body parameter in resources/views/pages/show.blade.php, with publicly available exploit code and a CVSS score of 2.1 reflecting low confidentiality/integrity impact. The vulnerability affects an unmaintained product with an inactive code repository, limiting real-world exposure but enabling opportunistic exploitation of legacy deployments.

Technical ContextAI

Bootstrap CMS is a Laravel-based content management system using Blade templating (resources/views/pages/show.blade.php). The vulnerability is CWE-74 (Improper Neutralization of Special Elements in Output), a code injection class affecting PHP template engines. The page creation handler fails to sanitize or escape the 'body' parameter before rendering it in Blade templates, allowing attackers with authenticated access (PR:L per CVSS vector) to inject arbitrary PHP/Blade directives that execute server-side. This is a classic template injection vulnerability in Laravel applications where user input reaches template rendering without proper escaping via functions like htmlspecialchars() or Blade's {{ }} auto-escape syntax.

Affected ProductsAI

Bootstrap CMS version 0.9.0-alpha is explicitly affected. The project's code repository has been inactive for many years, and no patched versions are available. All instances of Bootstrap CMS 0.9.0-alpha and likely earlier/concurrent versions in the 0.9.x line are impacted. This is a pre-release/alpha product with no production-grade support from the maintainer.

RemediationAI

No vendor-released patch is available because the Bootstrap CMS project is unmaintained and the repository inactive. Organizations should immediately migrate away from Bootstrap CMS to an actively maintained alternative (such as Laravel Nova, Filament, or modern Headless CMS platforms). If legacy deployments cannot be immediately decommissioned, implement compensating controls: (1) Restrict access to the page creation/editing interface via firewall, reverse proxy, or application-level IP whitelisting to authorized administrator networks only; (2) Disable the page creation handler entirely in routes if not in active use; (3) Apply Web Application Firewall (WAF) rules to detect and block Blade template directives ({{ }}, {!! !!}, @php) in POST/PUT request bodies to /pages endpoints; (4) Enforce strong, unique authentication credentials and implement rate-limiting on login attempts to reduce account compromise risk. Each mitigation has trade-offs: network restriction limits remote management; disabling features reduces functionality; WAF rules may block legitimate user content containing curly braces.