PT-2026-29152 · Basercms · Basercms

Kaminuma · Publicado 2026-03-31 · Atualizado 2026-03-31 · CVE-2026-30940

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions baserCMS versions prior to 5.2.3

Description baserCMS is a website development framework. A path traversal flaw exists in the theme file management API, specifically at the ''/baser/api/admin/bc-theme-file/theme files/add.json'' endpoint. An authenticated administrator can manipulate the path parameter using '..' sequences to create PHP files in locations outside the intended theme directory. This could lead to remote code execution (RCE). The vulnerable parameter is the path parameter.

Recommendations Update to version 5.2.3 or later.

Exploit

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-73

CWE-22

Identificadores relacionados

CVE-2026-30940

GHSA-C5C6-37VQ-PJCQ

Produtos afetados

Basercms

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30940.json · Exploit
• https://github.com/baserproject/basercms/security/advisories/GHSA-c5c6-37vq-pjcq · Aviso do Fabricante
• https://github.com/baserproject/basercms · Nota
• https://github.com/baserproject/basercms/releases/tag/5.2.3 · Nota
• https://twitter.com/CVEarity/status/2038909224441528739 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30940 · Aviso do Fabricante
• https://basercms.net/security/JVN_20837860 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30940 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-c5c6-37vq-pjcq · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2038916054672658929 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2038835935765238023 · Publicação no Twitter
• https://twitter.com/kaminuma_dev/status/2038920602967478611 · Publicação no Twitter