Description
A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is advised.
Published: 2026-08-31
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in Yaojingang GEOFlow’s Superadmin Theme Editor preview functionality, specifically in app/Http/Controllers/Admin/SiteThemeEditorController.php. An attacker can manipulate the 'blade' argument to inject arbitrary code, leading to remote code execution. The flaw is already detected and publicly disclosed, meaning attackers can exploit it over the network without local access.

Affected Systems

Any installation of yaojingang GEOFlow version 2.1.0 or older is affected. The issue resides in the Superadmin Theme Editor component. Version 2.1.1 contains the patch identified by commit 67abfd864a15d169a78429f3290c91cb3b93e849 and resolves the flaw.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate potential impact. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires remote access to the preview endpoint, and an attacker can trigger code injection by crafting a request that modifies the 'blade' parameter. The lack of a KEV listing does not diminish the risk; the publicly available exploit indicates that exploitation is feasible and potentially widespread.

Generated by OpenCVE AI on August 31, 2026 at 09:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch revision 67abfd864a15d169a78429f3290c91cb3b93e849 to suppress the vulnerable code path.
  • Upgrade yaojingang GEOFlow to version 2.1.1 or newer, which incorporates the fix.
  • If an upgrade is not immediately possible, restrict access to the Superadmin Theme Editor preview feature or sanitize the 'blade' input to prevent arbitrary code execution.

Generated by OpenCVE AI on August 31, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is advised.
Title yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection
First Time appeared Yaojingang
Yaojingang geoflow
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:yaojingang:geoflow:*:*:*:*:*:*:*:*
Vendors & Products Yaojingang
Yaojingang geoflow
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Yaojingang Geoflow
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T08:30:12.223Z

Reserved: 2026-08-30T14:44:05.793Z

Link: CVE-2026-82666

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T09:17:04.747

Modified: 2026-08-31T09:17:04.747

Link: CVE-2026-82666

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T09:30:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')