SB2026073057 - Multiple vulnerabilities in baserCMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026073057

SB2026073057 - Multiple vulnerabilities in baserCMS

Published: July 30, 2026

Security Bulletin ID SB2026073057
CSH Severity
High
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 8% Medium 31% Low 62%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 vulnerabilities.


1) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in BcDatabaseService.php when processing database backup and restore operations. A remote user can inject crafted SQL identifiers and database input to disclose sensitive information.

Exploitation requires valid login access and was demonstrated through the backup download and restore workflow.


2) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to code injection in schema file loading in BcDatabaseService.php when restoring a backup containing a crafted schema PHP file. A remote user can upload a malicious backup archive to execute arbitrary code.

The schema validation can be bypassed because PHP code outside the class definition executes unconditionally during require_once processing.


3) Improper Neutralization of Formula Elements in a CSV File (CVE-ID: CVE-2026-65875)

CWE-ID: CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary commands on the administrator's workstation.

The vulnerability exists due to improper neutralization of formula elements in a CSV file in the Contact Form CSV export feature when processing user-supplied contact form input for CSV export. A remote attacker can submit input containing a spreadsheet formula payload to execute arbitrary commands on the administrator's workstation.

User interaction is required when an authenticated user opens the exported CSV file in a spreadsheet application such as Excel or LibreOffice Calc.


4) SQL injection (CVE-ID: CVE-2026-62951)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information from the database.

The vulnerability exists due to SQL injection in the Blog Tags REST API ORDER BY clause in BlogTagsService::createIndexOrder() when processing the sort, direction, and order[] request parameters. A remote attacker can send a specially crafted request to disclose sensitive information from the database.

Exploitation is possible against the public API by supplying a spoofed same-site Referer header, and no user interaction is required.


5) OS Command Injection (CVE-ID: CVE-2026-62952)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to command injection in the update_core admin action and PluginsService::updateCore() and rollbackCore() when processing a user-supplied php path parameter. A remote privileged user can supply the path to an arbitrary executable on the filesystem to execute arbitrary code.

Exploitation requires chaining with another path traversal vulnerability.


6) Path traversal (CVE-ID: CVE-2026-62953)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to path traversal in PluginsService::add() and ThemesService::add() when handling uploaded filenames. A remote privileged user can supply a crafted filename in an upload request to execute arbitrary code.

If the webroot is writable, the uploaded payload can be written to a web-accessible location before ZIP validation fails, and no cleanup occurs afterward.


7) SQL injection (CVE-ID: CVE-2026-59872)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands and disclose sensitive information.

The vulnerability exists due to SQL injection in the Admin API endpoint and UploaderFilesService::createAdminIndexConditions() when processing user-supplied query parameters in the conditions array. A remote privileged user can send a specially crafted request to execute arbitrary SQL commands and disclose sensitive information.

In the default configuration, the database user may have FILE privilege, which can enable writing query results to the database server's configured file output directory.


8) Path traversal (CVE-ID: CVE-2026-62954)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to path traversal in the Theme File API when concatenating the ext parameter to the file name after the path-containment check. A remote privileged user can supply a crafted ext parameter containing traversal sequences to write attacker-controlled PHP into webroot/ and execute arbitrary code.

Direct external exploitation is possible when the core admin API is enabled; in the default configuration, exploitation requires chaining with another issue such as cross-site scripting.


9) Path traversal (CVE-ID: CVE-2026-62955)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to path traversal in BcThemeFileService::getFullpath() when handling a type value that maps to a non-existent theme subdirectory. A remote privileged user can supply a crafted path containing traversal sequences to execute arbitrary code.

The issue occurs because the directory traversal validation is skipped when realpath() returns false for the base directory, and exploitation can be used to write files outside the intended theme directory.


10) Code Injection (CVE-ID: CVE-2026-62969)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of code generation in the database restore feature when processing an uploaded restore archive. A remote privileged user can upload a specially crafted archive containing a malicious PHP schema file to execute arbitrary code.

The uploaded file is executed during restore via require_once even if an error is later displayed.


11) Improper Authorization (CVE-ID: CVE-2026-63012)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in Api/Admin endpoints configured with auth => true when processing requests with session authentication fallback. A remote user can send a request with a Referer header to access the API without holding a JWT to disclose sensitive information.

The issue affects operator accounts whose default group has auth_prefix set to 'Admin', and exploitation relies on session authentication becoming active for the Api/Admin prefix.


12) SQL injection (CVE-ID: CVE-2026-62950)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary SQL queries and disclose sensitive information.

The vulnerability exists due to SQL injection in BlogTagsService::createIndexOrder() when processing the sort and direction query parameters in the blog tags listing endpoint. A remote attacker can send a specially crafted request to execute arbitrary SQL queries and disclose sensitive information.

The issue is reachable without authentication via the public API route when USE_CORE_API="true", and the same vulnerable code path is also exposed through the admin route.


13) SQL injection (CVE-ID: CVE-2026-62956)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL queries against the database.

The vulnerability exists due to SQL injection in MailMessagesService::getIndex() when processing the order and direction query parameters for the mail messages listing endpoint. A remote user can send a specially crafted request to execute arbitrary SQL queries against the database.

The injected payload may be persisted in the server-side session, causing re-execution on subsequent page loads, and the issue affects both the admin and API mail messages listing endpoints.


Remediation

Install update from vendor's website.

References