An unsanitized tpl (template) parameter is passed directly into a require_once() statement, eliminating path validation. An authenticated administrator can insert path‑traversal sequences to escape the intended theme directory and include any file from the server, such as the media/ directory. When coupled with the ability to upload files, an attacker can place a PHP payload disguised as an image, then use the traversal flaw to require that file and execute the malicious code under web‑server privileges.

BoidCMS versions prior to 2.1.3 are affected. The product is the open‑source, PHP‑based flat‑file CMS developed by BoidCMS.

The vulnerability carries a CVSS score of 7.2, indicating high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires authenticated administrator access to create or update a page, so it is not publicly exploitable without credentials. Nevertheless, once a privileged user is compromised, an attacker can achieve arbitrary code execution on the host. The likely attack vector is remote, dependent on legitimate credentials and the presence of file upload capabilities.