SB2026032721 - Multiple vulnerabilities in baserCMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026032721

SB2026032721 - Multiple vulnerabilities in baserCMS

Published: March 27, 2026 Updated: April 27, 2026

Security Bulletin ID SB2026032721
CSH Severity
High
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 22% Medium 11% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Stored cross-site scripting (CVE-ID: CVE-2026-30879)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


2) OS Command Injection (CVE-ID: CVE-2026-30880)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) SQL injection (CVE-ID: CVE-2026-27697)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.


4) Stored cross-site scripting (CVE-ID: CVE-2026-32734)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


5) OS Command Injection (CVE-ID: CVE-2026-30877)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary OS commands.

The vulnerability exists due to improper neutralization of special elements used in an OS command in the update functionality when handling update operations. A remote privileged user can send crafted input to execute arbitrary OS commands.

Commands are executed with the privileges of the user account running baserCMS.


6) Improper Authorization (CVE-ID: CVE-2026-30878)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to submit unauthorized mail form entries.

The vulnerability exists due to improper authorization in MailMessagesController.php::add() when handling public API mail submission requests. A remote attacker can send a specially crafted request to submit unauthorized mail form entries.

A valid CSRF cookie and token pair is required for exploitation.


7) Path traversal (CVE-ID: CVE-2026-30940)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to path traversal in the theme file management API endpoint /baser/api/admin/bc-theme-file/theme_files/add.json when processing the path parameter in file creation requests. A remote privileged user can send a specially crafted API request with ../ sequences to write a php file outside the theme directory and execute arbitrary code.

Direct exploitation requires API access, such as when USE_CORE_ADMIN_API=true.


8) OS Command Injection (CVE-ID: CVE-2026-21861)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary OS commands on the server.

The vulnerability exists due to improper neutralization of special elements used in an OS command in the core update functionality when handling a POST request to the get_core_update endpoint. A remote privileged user can send a specially crafted request with a malicious php parameter to execute arbitrary OS commands on the server.

The issue affects PluginsController::get_core_update(), PluginsService::getCoreUpdate(), and the /baser/admin/baser-core/plugins/get_core_update endpoint.


9) Improper access control (CVE-ID: CVE-2025-32957)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in the restore function in BcDatabasesService.php when processing uploaded backup zip files. A remote privileged user can upload a specially crafted zip archive containing a malicious PHP file to execute arbitrary code.

The uploaded archive is automatically extracted, and a PHP file inside the archive is included using require_once without validating or restricting the filename.


Remediation

Install update from vendor's website.

References