CVE-2026-7508 Details
Description
A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The code repository of the project has not been active for many years. This vulnerability only affects products that are no longer supported by the maintainer.
A remote code execution vulnerability has been identified in Bootstrap CMS version 0.9.0-alpha. The issue arises in the Page Creation Handler component, specifically within the file resources/views/pages/show.blade.php. The vulnerability allows for code injection by manipulating the body argument, as the application uses PHP's eval() function to execute user-supplied content without any sanitization. This flaw can be exploited remotely, and the exploit has been made public. The vulnerability affects an unsupported version of Bootstrap CMS.
To address this vulnerability, the 'eval' configuration option should be set to false in the config/cms.php file. Additionally, the eval() functionality should be removed entirely, or if dynamic content execution is necessary, a secure templating engine with sandbox restrictions should be implemented.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 30, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/803531 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360316 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/360316/cti | [email protected] | AdvisoryPermission Required |
| https://www.yuque.com/fortune-toq55/giqwnb/ra0b34kzmqn8e0m1 | [email protected] | ExploitTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Graham Campbell Bootstrap CMS | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | New CVE Received | [email protected] |