External risk intelligence

BloofoxCMS Arbitrary File Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2023-27812

bloofoxCMS is a web-based content management system. By definition, web applications are designed to be served over HTTP/HTTPS, making them typically internet-facing or reachable via a corporate network edge in standard deployments.

Path Traversal

Bloofoxcms

0.5.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in bloofox content management software allows for unauthorized file deletion. This flaw, identified in version 0.5.2, could potentially impact data integrity and system availability if exploited. The main concern at this time is confirming if this specific software is in use within our environment.

Deletes files remotely without authorization.
Critical flaw in content management software.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a vulnerable bloofoxCMS instance. This request would target the `delete_file()` function, allowing the attacker to remove arbitrary files from the server.

Publicly accessible without authentication.
Triggers arbitrary file deletion via function.
Leads to data loss or system disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to delete arbitrary files on a server running bloofoxCMS when supported by the advisory. This could impact system stability and potentially lead to service disruption.

System files and configurations could be deleted.
An attacker could trigger file deletion through a network request.
Service disruption or instability may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The identified arbitrary file deletion vulnerability in bloofoxcms is critical and network-exploitable, meaning external attackers could potentially cause significant damage. System owners and application teams should prioritize confirming the presence and exposure of this technology. The immediate first step is to identify all instances of bloofoxcms, assess their reachability and business criticality, and then determine the accountable owner to plan remediation based on the assessed risk.

Application owners should own the issue.
Verify bloofoxcms presence and network exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is bloofoxCMS?

bloofoxCMS is a PHP-based content management system used to build and maintain websites. It provides a web-based interface for managing site content, templates, and administrative tasks. Because it runs on a web server, it serves as the foundation for a site's digital presence and data storage.

What does CWE-22 mean for CVE-2023-27812?

CWE-22 refers to improper limitation of a pathname to a restricted directory, commonly known as path traversal. In the context of this vulnerability, it means the software does not properly validate file paths before processing them, which allows the delete_file() function to delete files outside of the intended directory on the server.

How can an attacker trigger this file deletion?

An attacker can trigger this vulnerability by sending a specially crafted network request to the affected server. No authentication is required to initiate the request, meaning a remote attacker can target the function directly. Simply browsing the site or performing standard administrative actions does not trigger the bug; it requires a specific, malicious input designed to reach the vulnerable function.

Why should I be concerned about this bloofoxCMS issue?

Halo Surface Signal indicates that because bloofoxCMS is a web-based application, it is typically designed to be accessible over the internet. This increases the risk because the vulnerability does not require a local presence, meaning an attacker anywhere on the network can attempt to delete sensitive system or configuration files, potentially rendering the service unusable.

Do I need to take action if I run this software?

Yes. Your first priority is to audit your environment to identify any servers running bloofoxCMS version 0.5.2. Once identified, evaluate whether the instance is reachable over the network and determine its business importance. Consult with the application owner to assess the risk and begin planning remediation steps to protect your system from potential data loss or service disruption.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.