Deserialization of Untrusted Data in baserCMS - CVE-2026-114624
Published: October 25, 2026
Vulnerability identifier: #VU157655
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114624
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary commands as the web server user.
The vulnerability exists due to deserialization of untrusted data in the baserCMS widget area entity when reading stored widget values without restricting allowed PHP classes. A remote privileged user can submit a serialized object as a string through the admin API, bypassing array-only serialization on save, to instantiate arbitrary PHP objects on subsequent page loads and execute commands through gadget chains in the default dependencies.
Affected software
baserCMS
How to mitigate CVE-2026-114624
Install security update from vendor's website.
baserCMS - addressed in versions 5.3.2, 5.4.2