CVE-2026-30877

CRITICAL

baserCMS: OS Command Injection in the baserCMS Update Functionality

Title source: cna
STIX 2.1

Description

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.

References (3)

Core 3
Core References
X_Refsource_Misc x_refsource_misc
https://basercms.net/security/JVN_20837860

Scores

CVSS v3 9.1
EPSS 0.0152
EPSS Percentile 71.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (3)
basercms/basercms < 5.2.3
baserproject/basercms 0 - 5.2.3Packagist
baserproject/basercms < 5.2.3
Published Mar 31, 2026
Tracked Since Mar 31, 2026