The vulnerability allows an attacker to inject malicious code into the Blade template used by the Page Creation Handler, specifically the file resources/views/pages/show.blade.php. By manipulating the body argument, an attacker can cause the server to execute unintended PHP code. This can lead to full compromise of the affected server, exposing confidential data, altering system integrity, and potentially shutting down services. The flaw is a direct instance of server‑side template injection, providing a clear path for remote code execution.

Bootstrap CMS version 0.9.0‑alpha is the only affected release, and it is not actively maintained. The vulnerability resides in a function of the resources/views/pages/show.blade.php file within the Page Creation Handler component.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The available public exploit demonstrates that the flaw can be triggered remotely via HTTP requests. Because the product is unsupported, no official patch exists to remediate the flaw, increasing the urgency for mitigations to prevent exploitation.