CVE-2026-114623: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in baserproject basercms

baserCMS's optional BcThemeFile plugin in versions >=5.0.0 <5.3.2 and >=5.4.0 <5.4.2 allows authenticated users with theme-file view permission to perform path traversal via the ThemeFilesController::parseArgs() method. This method constructs file paths containing '../' segments without proper containment validation before passing them to ThemeFilesService::get(). Authorization checks occur on the unresolved path, but the resolved path is used to read file contents, exposing sensitive files such as config/install.php and config/app_local.php. The vulnerability is limited to reading files with extensions .php, .css, .js, and .ctp and does not disclose .env, .pem, or SQLite database files. The plugin is disabled by default, and unauthenticated access is not sufficient to exploit this issue. The flaw does not permit file modification or code execution. Patches are available in versions 5.3.2 and 5.4.2.

An attacker with authenticated access and theme-file view permission can read sensitive files outside the intended theme directory, potentially exposing application source code, database credentials for MySQL or PostgreSQL, and security salts. This exposure can aid further attacks or unauthorized access. However, the vulnerability does not allow file modification, code execution, or disclosure of certain sensitive files like .env or private keys. The plugin is disabled by default, limiting exposure.

This vulnerability has been officially fixed in baserCMS versions 5.3.2 and 5.4.2. Users should upgrade to these or later versions to remediate the issue. Since the BcThemeFile plugin is disabled by default, disabling it if not needed also reduces risk. No additional action is required if the plugin is not enabled or if the system is updated to the fixed versions.