PT-2026-29145 · Basercms · Basercms

CVE-2025-32957 · Publicado 2026-03-31 · Atualizado 2026-03-31

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions baserCMS versions prior to 5.2.3

Description baserCMS is a website development framework. The application’s restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file within the archive is included using the require once function without validating or restricting the filename. An attacker can craft a malicious PHP file within the .zip archive and achieve arbitrary code execution when it is included. The require once function is used to include the PHP file. The vulnerability is exploitable through malicious .zip file uploads.

Recommendations Versions prior to 5.2.3 should be updated to version 5.2.3.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2025-32957

GHSA-HV78-CWP4-8R7R

Produtos afetados

Basercms

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32957.json · Exploit
• 🔥 https://github.com/baserproject/basercms/security/advisories/GHSA-hv78-cwp4-8r7r · Exploit
• https://github.com/baserproject/basercms/releases/tag/5.2.3 · Nota
• https://github.com/baserproject/basercms · Nota
• https://twitter.com/TheHackerWire/status/2038787693912654015 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2038787840524624288 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-hv78-cwp4-8r7r · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2038794125831532756 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-32957 · Aviso do Fabricante
• https://basercms.net/security/JVN_20837860 · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2038889761080041674 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2038916060465045938 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-32957 · Nota de Segurança