OS Command Injection in baserCMS - CVE-2026-30877
Published: April 27, 2026
Vulnerability identifier: #VU128063
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-30877
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary OS commands.
The vulnerability exists due to improper neutralization of special elements used in an OS command in the update functionality when handling update operations. A remote privileged user can send crafted input to execute arbitrary OS commands.
Commands are executed with the privileges of the user account running baserCMS.
Affected software
baserCMS
How to mitigate CVE-2026-30877
Install security update from vendor's website.
baserCMS - update to 5.2.3