CVE-2023-38836

File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

76.03% chance of exploitation in the next 30 days, 100th percentile

Published

2023-08-21

Updated

2026-07-09

Proof-of-concept exploits (1)

• 1337kid/CVE-2023-388365★ · 2024-07-05

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cve_2023_38836_boidcm…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51741

Security advisories

• BoidCMS/BoidCMS/issues/27

References

• CVE Record
• NVD entry

Related

• CVE-2023-37628
• CVE-2023-37629
• CVE-2023-37630