Path traversal in baserCMS - CVE-2026-114622
Published: October 25, 2026
Vulnerability identifier: #VU157662
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114622
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to write arbitrary files outside the theme directory and execute arbitrary PHP code with the web server user's privileges.
The vulnerability exists due to path traversal caused by checking path containment before URL decoding in the baserCMS BcThemeFile theme file API when processing file update requests. A remote privileged user can submit a crafted request to /baser/api/admin/bc-theme-file/theme_files/edit.json with %2e%2e%2f traversal sequences in the path to bypass the containment checks, write PHP files into webroot/, and execute them over HTTP.
Exploitation requires the BcThemeFile plugin to be installed.
Affected software
baserCMS
How to mitigate CVE-2026-114622
Install security update from vendor's website.
baserCMS - addressed in versions 5.3.2, 5.4.2