PT-2026-29145 · Basercms · Basercms

Published 2026-03-31 · Updated 2026-03-31 · CVE-2025-32957

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions baserCMS versions prior to 5.2.3

Description baserCMS is a website development framework. The application’s restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file within the archive is included using the require once function without validating or restricting the filename. An attacker can craft a malicious PHP file within the .zip archive and achieve arbitrary code execution when it is included. The require once function is used to include the PHP file. The vulnerability is exploitable through malicious .zip file uploads.

Recommendations Versions prior to 5.2.3 should be updated to version 5.2.3.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-32957

GHSA-HV78-CWP4-8R7R

Affected Products

Basercms

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32957.json · Exploit
• 🔥 https://github.com/baserproject/basercms/security/advisories/GHSA-hv78-cwp4-8r7r · Exploit
• https://osv.dev/vulnerability/GHSA-hv78-cwp4-8r7r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32957 · Vendor Advisory
• https://basercms.net/security/JVN_20837860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32957 · Security Note
• https://github.com/baserproject/basercms/releases/tag/5.2.3 · Note
• https://github.com/baserproject/basercms · Note
• https://twitter.com/TheHackerWire/status/2038787693912654015 · Twitter Post
• https://twitter.com/TheHackerWire/status/2038787840524624288 · Twitter Post
• https://twitter.com/CveFindCom/status/2038794125831532756 · Twitter Post
• https://twitter.com/CVEarity/status/2038889761080041674 · Twitter Post
• https://twitter.com/CVEnew/status/2038916060465045938 · Twitter Post