CVE-2026-114622: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in baserproject basercms

The vulnerability in baserCMS's BcThemeFile plugin involves improper limitation of a pathname to a restricted directory (CWE-22). The Admin API validates raw paths in ThemeFilesService::update() and getFullpath(), but subsequently applies rawurldecode() to the full path before writing. Because normalizePath() only resolves literal dot segments, percent-encoded traversal sequences bypass containment checks, enabling path traversal outside the theme directory. An authenticated administrator can exploit this to write and execute PHP files in writable locations like the webroot, exceeding intended editing boundaries. The vulnerability requires the plugin to be enabled, an administrator session, and a same-origin Origin header. The Admin web form is not affected due to FormProtection. This issue is a third bypass related to CVE-2026-30940 and has been fixed in baserCMS versions 5.3.2 and 5.4.2.

An authenticated administrator can exploit this vulnerability to write arbitrary PHP files to writable locations outside the theme directory, such as the webroot, and execute them. This leads to full compromise of the web application, including confidentiality, integrity, and availability impacts (CVSS 7.2). The attack bypasses intended theme-template editing restrictions, potentially allowing remote code execution within the context of the web server.

This vulnerability has been officially fixed in baserCMS versions 5.3.2 and 5.4.2. Users should upgrade to these versions or later to remediate the issue. No additional mitigation is required if these versions are deployed. Exploitation requires the optional BcThemeFile plugin and an administrator session, so disabling the plugin or restricting administrator access may reduce risk temporarily but is not a substitute for patching.