CVE-2026-39387·PHP vulnerability
BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to Remote Code Execution (RCE).The application fails to sanitize the tpl (template) parameter during page creation and updates. This parameter is passed directly to a require_once() statement without path validation. An authenticated administrator can exploit this by injecting path traversal sequences (../) into the tpl value to escape the intended theme directory and include arbitrary files — specifically, files from the server's media/ directory. When combined with the file upload functionality, this becomes a full RCE chain: an attacker can first upload a file with embedded PHP code (e.g., disguised as image data), then use the path traversal vulnerability to include that file via require_once(), executing the embedded code with web server privileges. This issue has been fixed in version 2.1.3.
- Severity
- high
- Software
- PHP
- Fixed in
- 2.1.3
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.34% — higher than 56% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Read the two together. CVE-2026-39387 scores 7.2 on CVSS, so a successful attack would be serious — but at 0.34%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.
Affected versions
Until: 2.1.3
Fixed in: 2.1.3
How to fix this CVE
If you are running BoidCMS, immediately update to version 2.1.3 or later, which includes proper input validation and path sanitization for the template parameter. For general PHP installations, ensure you are running PHP 8.1 or later with security updates applied. Review any uploaded files in your media directory and remove suspicious or unexpected content that may have been introduced through this vulnerability.
sudo dnf check-update php && sudo dnf update phpDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
POST|GET /.*?admin.*?page.*? HTTP.*tpl=.*\.\./.*|POST.*media.*phpWAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Block or sanitize HTTP requests containing the 'tpl' parameter with path traversal sequences (../ or ..) before they reach the application. Additionally, prevent execution of PHP files in the media/ directory by configuring web server to deny script execution in upload directories (e.g., via .htaccess or nginx location blocks).How to check if you are affected
- Step 1: Check BoidCMS version with: grep -r "VERSION" /path/to/boidcms/config/ or examine the releases page at https://github.com/BoidCMS/BoidCMS/releases
- Step 2: Verify if the 'tpl' parameter validation is in place by reviewing /path/to/boidcms/core/pages.php or equivalent template handling code for path traversal filters
- Step 3: Search web server logs for suspicious 'tpl' parameter values containing '../' sequences: grep -i 'tpl=.*\.\./.*' /var/log/apache2/access.log or /var/log/nginx/access.log
- Step 4: Confirm the patch by running: php --version and checking BoidCMS version tag matches 2.1.3+, then verify no unauthorized .php files exist in the media/ directory with: find /path/to/boidcms/media -name '*.php' -type f
FAQ
What is CVE-2026-39387?
CVE-2026-39387 is a Local File Inclusion (LFI) vulnerability in BoidCMS versions prior to 2.1.3 that allows authenticated administrators to exploit path traversal in the template parameter, potentially leading to Remote Code Execution when combined with file upload functionality.
Is CVE-2026-39387 being actively exploited?
No, CVE-2026-39387 is not currently listed on the CISA Known Exploited Vulnerabilities catalog, and no public exploits have been released, though the vulnerability requires administrator-level access to trigger.
What versions of PHP are affected by CVE-2026-39387?
BoidCMS versions up to and including 2.1.2 are affected; the vulnerability is fixed in version 2.1.3 and later. The issue exists regardless of PHP version but affects systems running vulnerable BoidCMS instances.
How do I check if my server is vulnerable to CVE-2026-39387?
Check your BoidCMS version by examining the GitHub releases or your installation directory; if the version is below 2.1.3, you are vulnerable. Also verify that file uploads to the media/ directory are possible and that the tpl parameter in page creation forms is not sanitized.
Does Defensia detect CVE-2026-39387?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If BoidCMS or PHP is installed on a monitored server, CVE-2026-39387 will appear in your dashboard with remediation steps.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-39387. Free for 1 server.
Get started free