PT-2026-29148 · Baserproject · Basercms

Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-30877

Mitre

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-30877

Affected Products

Basercms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-30877 · Security Note
• https://github.com/baserproject/basercms/security/advisories/GHSA-m9g7-rgfc-jcm7 · Note
• https://basercms.net/security/JVN_20837860 · Note
• https://github.com/baserproject/basercms/releases/tag/5.2.3 · Note