SB2026102517 - Multiple vulnerabilities in baserCMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102517

SB2026102517 - Multiple vulnerabilities in baserCMS

Published: October 25, 2026

Security Bulletin ID SB2026102517
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Deserialization of Untrusted Data (CVE-ID: CVE-2026-114624)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary commands as the web server user.

The vulnerability exists due to deserialization of untrusted data in the baserCMS widget area entity when reading stored widget values without restricting allowed PHP classes. A remote privileged user can submit a serialized object as a string through the admin API, bypassing array-only serialization on save, to instantiate arbitrary PHP objects on subsequent page loads and execute commands through gadget chains in the default dependencies.


2) Cross-site scripting (CVE-ID: CVE-2026-115457)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary JavaScript in the site's origin in the browsers of visitors, including administrators, who view an affected blog article.

The vulnerability exists due to improper neutralization of the apiBaseUrl argument in the Google Maps shortcode when expanding visitor-submitted blog comments after HTML rendering. A remote attacker can submit a comment containing [BcBaser.getGoogleMaps apiKey|k|apiBaseUrl|//localhost:9999/xss.js?], which expands to <script src="//localhost:9999/xss.js??key=k"></script>, to execute attacker-controlled JavaScript when a visitor opens the article.


3) Path traversal (CVE-ID: CVE-2026-114623)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read sensitive server-side files outside the theme directory, including application configuration files containing plaintext database credentials.

The vulnerability exists due to missing path traversal validation in ThemeFilesService::get() in the baserCMS BcThemeFile admin screen when handling file viewing requests with the plugin enabled. A remote user can use theme file view permission to send a crafted request to /baser/admin/bc-theme-file/theme_files/view/BcThemeSample/layout/../../../../config/install.php to disclose configuration contents, because access control checks the raw request path before the filesystem resolves the traversal.


4) SQL injection (CVE-ID: CVE-2026-114621)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL queries to disclose or modify database contents and disrupt database availability.

The vulnerability exists due to improper neutralization of SQL query elements in the list and detail actions of the baserCMS admin panel and admin API when passing request query parameters directly to the ORM as options. A remote user can embed SQL fragments in the contain, conditions, fields, finder, or order query parameters to execute arbitrary SQL, including reading password hashes from the users table.


5) Improper control of interaction frequency (CVE-ID: CVE-2026-115480)

CWE-ID: CWE-799 - Improper Control of Interaction Frequency

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass image captcha protection on baserCMS mail forms and submit automated spam or abuse the site's mail service to send attacker-composed messages to third parties.

The vulnerability exists due to missing captcha verification and improper control of interaction frequency in the public mail-form API's BcMailControllerApiMailMessagesController::add() action when processing form submissions. A remote attacker can send repeated POST requests to /baser/api/bc-mail/mail_messages/add/{mailContentId}.json with valid form data but without captcha_id or auth_captcha parameters to submit messages without solving the configured captcha and trigger outgoing email.


6) Input validation error (CVE-ID: CVE-2026-115479)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to abuse the site's automatic email replies to send unsolicited messages to multiple arbitrary recipients under the site's identity.

The vulnerability exists due to improper input validation in the baserCMS mail form's sendFormToUser() method in plugins/bc-mail/src/Mailer/MailMessageMailer.php when processing visitor-supplied email addresses without server-side email format validation. A remote attacker can submit a comma-separated value such as a@example.com,b@example.net,c@example.org while bypassing browser-side validation, causing parseAndNormalizeMailAddresses() to split the value and pass all addresses to setTo(), to send automatic replies containing visitor-supplied content to those recipients.


7) Incorrect default permissions (CVE-ID: CVE-2026-115481)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access plugin administration functionality that would otherwise be denied to their user group.

The vulnerability exists due to incorrect default permissions in PermissionGroupsService::build() when installing a plugin without config/permission.php with access enabled for all users. A remote user can access plugin routes covered by automatically generated wildcard allow rules to perform administrative operations, including configuring BcCustomContent file fields.


8) Path traversal (CVE-ID: CVE-2026-114622)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to write arbitrary files outside the theme directory and execute arbitrary PHP code with the web server user's privileges.

The vulnerability exists due to path traversal caused by checking path containment before URL decoding in the baserCMS BcThemeFile theme file API when processing file update requests. A remote privileged user can submit a crafted request to /baser/api/admin/bc-theme-file/theme_files/edit.json with %2e%2e%2f traversal sequences in the path to bypass the containment checks, write PHP files into webroot/, and execute them over HTTP.

Exploitation requires the BcThemeFile plugin to be installed.


Remediation

Install update from vendor's website.

References