by Kastro
Paper/Archive/CVE-2026-30877

CVE-2026-30877

baserproject basercms — baserCMS: OS Command Injection in the baserCMS Update Functionality

EPSS 2%CVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 75.0.750 × 2015.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.

Affected

ProductAffectedFixed inSource
basercms< 5.2.3–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/baserproject/basercms/security/advisories/GHSA-m9g7-rgfc-jcm7refbasercms.net/security/JVN_20837860refgithub.com/baserproject/basercms/releases/tag/5.2.3