SQL injection in baserCMS - CVE-2026-59872
Published: July 30, 2026
Vulnerability identifier: #VU140528
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59872
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL commands and disclose sensitive information.
The vulnerability exists due to SQL injection in the Admin API endpoint and UploaderFilesService::createAdminIndexConditions() when processing user-supplied query parameters in the conditions array. A remote privileged user can send a specially crafted request to execute arbitrary SQL commands and disclose sensitive information.
In the default configuration, the database user may have FILE privilege, which can enable writing query results to the database server's configured file output directory.
Affected software
baserCMS
How to mitigate CVE-2026-59872
Install security update from vendor's website.
baserCMS - update to 5.3.0