CVE-2026-7508

Bootstrap CMS Page Creation show.blade.php code injection

View on CVE.org
Published Apr 30, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The code repository of the project has not been active for many years. This vulnerability only affects products that are no longer supported by the maintainer.

Analysis

AI-generated

Technical impact

The vulnerability allows an attacker to inject malicious code into the Blade template used by the Page Creation Handler, specifically the file resources/views/pages/show.blade.php. By manipulating the body argument, an attacker can cause the server to execute unintended PHP code. This can lead to full compromise of the affected server, exposing confidential data, altering system integrity, and potentially shutting down services. The flaw is a direct instance of server‑side template injection, providing a clear path for remote code execution.

Affected Systems

Bootstrap CMS version 0.9.0‑alpha is the only affected release, and it is not actively maintained. The vulnerability resides in a function of the resources/views/pages/show.blade.php file within the Page Creation Handler component.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The available public exploit demonstrates that the flaw can be triggered remotely via HTTP requests. Because the product is unsupported, no official patch exists to remediate the flaw, increasing the urgency for mitigations to prevent exploitation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Disable or remove Bootstrap CMS from your environment entirely.
  • If removal is not possible, restrict access to the HTML page rendering endpoint so that only trusted IP addresses can reach it.
  • Continuously monitor web traffic for anomalous body parameters or attempts to inject code, and block any that deviate from expected input patterns.

Generated by OpenCVE AI on May 1, 2026 at 04:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Bootstrap
Bootstrap cms
Vendors & Products Bootstrap
Bootstrap cms
Type Values Removed Values Added
Description A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The code repository of the project has not been active for many years. This vulnerability only affects products that are no longer supported by the maintainer.
Title Bootstrap CMS Page Creation show.blade.php code injection
Weaknesses CWE-74
CWE-94
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 4, 2026, 1:26 PM
Reserved
Apr 30, 2026, 2:58 PM

View source JSON

Updated
May 4, 2026, 1:26 PM

JSON

Status
Deferred
Published
Apr 30, 2026, 11:16 PM
Modified
Oct 26, 2026, 10:10 PM

View source JSON

No data.

Updated
May 1, 2026, 8:20 AM

JSON