Loading vulnerability…
BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to Remote Code Execution (RCE).The application fails to sanitize the tpl (template) parameter during page creation and updates. This parameter is passed directly to a require_once() statement without path validation. An authenticated administrator can exploit this by injecting path traversal sequences (../) into the tpl value to escape the intended theme directory and include arbitrary files — specifically, files from the server's media/ directory. When combined with the file upload functionality, this becomes a full RCE chain: an attacker can first upload a file with embedded PHP code (e.g., disguised as image data), then use the path traversal vulnerability to include that file via require_once(), executing the embedded code with web server privileges. This issue has been fixed in version 2.1.3.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Single-file Python exploit targeting BoidCMS <= 2.1.2 for CVE-2026-39387. The script is a real authenticated RCE exploit, not just a detector. It uses requests.Session() to maintain cookies, scrapes a 64-character CSRF token from HTML forms, logs into the BoidCMS admin panel with supplied credentials, uploads a GIF/PHP polyglot file named shell.gif to the media area, and then creates a new CMS page whose tpl field is set to ../../media/shell.gif. This abuses template inclusion/path traversal behavior so the uploaded file is interpreted as PHP when the new page is requested. After setup, the script enters an interactive loop and sends commands to the published page using the cmd query parameter, with the PHP payload executing system() on the server. Repository structure is minimal: one Python script with argparse-based CLI handling and no auxiliary files. Main exploit capabilities are authenticated login, CSRF token harvesting, arbitrary file upload, malicious page creation, template injection/LFI-style inclusion, and interactive remote command execution over HTTP.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.