OS Command Injection in baserCMS - CVE-2026-62952
Published: July 30, 2026
Vulnerability identifier: #VU140526
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-62952
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to command injection in the update_core admin action and PluginsService::updateCore() and rollbackCore() when processing a user-supplied php path parameter. A remote privileged user can supply the path to an arbitrary executable on the filesystem to execute arbitrary code.
Exploitation requires chaining with another path traversal vulnerability.
Affected software
baserCMS
How to mitigate CVE-2026-62952
Install security update from vendor's website.
baserCMS - update to 5.3.0