Description

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-31T09:17:04.747Z",
  "pubdate": "2026-08-31T09:17:04.747Z",
  "executiveSummary": "A critical code injection vulnerability exists in the Superadmin Theme Editor component of yaojingang GEOFlow versions up to 2.1.0.\nThe flaw stems from improper input validation within the file app/Http/Controllers/Admin/SiteThemeEditorController.php, specifically involving the 'blade' argument during the preview function.\nThis vulnerability allows an unauthenticated or remote attacker to inject and execute arbitrary PHP code, potentially leading to full system compromise.\nGiven that proof-of-concept exploits are publicly available, the risk to affected systems is extremely high, necessitating immediate remediation.\nThe flaw allows attackers to achieve remote code execution (RCE) with the privileges of the web server process.",
  "technicalDetails": "The vulnerability resides in the Superadmin Theme Editor component of the GEOFlow platform, specifically within the preview mechanism managed by app/Http/Controllers/Admin/SiteThemeEditorController.php. The root cause is the insecure handling of the 'blade' argument, which is processed by the application's template engine without adequate sanitization or boundary validation.\nIn the context of Laravel-based applications, the 'blade' argument likely influences the rendering process of Blade templates. When an attacker provides a maliciously crafted string containing PHP code or Blade directives as the value for the 'blade' parameter, the application attempts to compile and execute this input as part of the theme preview workflow. Because the input is not strictly validated against a whitelist of authorized file paths or contents, the template engine interprets the payload as executable code.\nThe attack flow begins with the adversary targeting the specific endpoint mapped to the preview function within SiteThemeEditorController.php. By manipulating the HTTP request to inject arbitrary content into the 'blade' argument, the attacker forces the application to evaluate the injected template code. Since the application fails to isolate the execution environment or sanitize the input, the injected payload is executed on the server-side.\nThis vulnerability is particularly severe because it is remotely exploitable without requiring complex authentication hurdles in many configurations. Successful exploitation grants the attacker the ability to execute system commands, access sensitive configuration files (such as .env files containing database credentials and application keys), modify application files, or establish persistent backdoors.\nThe exposure extends across all installations of GEOFlow versions 2.1.0 and earlier. The lack of input normalization allows the payload to bypass standard security filters. Once code execution is achieved, the attacker operates with the same system permissions as the web server process (e.g., www-data), facilitating lateral movement or deeper system exploitation depending on the underlying server configuration."
}