PT-2026-29152 · Baserproject · Basercms

Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-30940

NVD

CVSS v3.1

7.2

High

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-30940

Affected Products

Basercms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-30940 · Security Note
• https://basercms.net/security/JVN_20837860 · Note
• https://github.com/baserproject/basercms/releases/tag/5.2.3 · Note
• https://github.com/baserproject/basercms/security/advisories/GHSA-c5c6-37vq-pjcq · Note