Input validation error in baserCMS - CVE-2026-115479
Published: October 25, 2026
Vulnerability details
The vulnerability allows a remote attacker to abuse the site's automatic email replies to send unsolicited messages to multiple arbitrary recipients under the site's identity.
The vulnerability exists due to improper input validation in the baserCMS mail form's sendFormToUser() method in plugins/bc-mail/src/Mailer/MailMessageMailer.php when processing visitor-supplied email addresses without server-side email format validation. A remote attacker can submit a comma-separated value such as a@example.com,b@example.net,c@example.org while bypassing browser-side validation, causing parseAndNormalizeMailAddresses() to split the value and pass all addresses to setTo(), to send automatic replies containing visitor-supplied content to those recipients.