Skip to main content
CVE-2026-114624VulnerabilityPublished 10/23/2026

CVE-2026-114624: CWE-502: Deserialization of Untrusted Data in baserproject basercms

Affects baserproject basercmsSource CVE Database V5

0

Not known to be exploited · CVSS 7.2 High : patch baserproject basercms soon.

Data as of 10/24/2026, 17:08:24 UTC

CVSS 3.1 base score
7.2High
How severe the flaw is on the 0–10 CVSS scale.
Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.9% chance of exploitation in 30 days – higher than 60% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What to do

Affected software

ProductAffectedFixed in
baserprojectbasercmsAffected
  • >=5.0.0 <5.3.2
  • >=5.4.0 <5.4.2
Fixed in–
GitHub Actionsbaserproject/basercmspkg:github/baserproject/basercmsOther threatsAffected
  • >=5.0.0 <5.3.2
  • >=5.4.0 <5.4.2
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix is available in baserCMS versions 5.3.2 and 5.4.2. Users should upgrade to these or later versions to remediate the vulnerability. Until patched, restrict administrative and widget-write access to trusted users only. Monitor and audit widget data for suspicious serialized content. Repair any affected database entries containing malicious payloads to prevent repeated execution.

Description

baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain a deserialization vulnerability in the widget-area entity. This flaw allows an administrator or an attacker with widget-write capability to store malicious serialized objects via the admin JSON API. These objects are deserialized without class restrictions, enabling remote code execution as the web-server user upon unauthenticated page access after payload storage. The vulnerability has been patched in versions 5.3.2 and 5.4.2.

Impact

Successful exploitation allows an attacker with administrative or widget-write privileges to achieve remote code execution as the web-server user. This can lead to full compromise of the web server and potentially the underlying system. The vulnerability enables repeated execution of malicious payloads until the affected database row is repaired. Unauthenticated users can trigger the payload execution after it is stored, but cannot plant the payload without privileges.

Summary

baserCMS's widget-area entity improperly deserializes untrusted data submitted through the admin JSON API. When the submitted value is a string rather than an array, it is stored unchanged and later deserialized using PHP's unserialize() without allowed_classes restrictions. This permits an attacker with administrative or widget-write privileges to inject crafted object graphs that trigger code execution via gadget chains involving composer/composer and logiscape/mcp-sdk-php dependencies. The deserialization bypasses constructor readonly safeguards and can repeatedly execute until the database entry is fixed. The initial payload planting requires privileges, but the execution trigger occurs on unauthenticated page requests. The issue is fixed in baserCMS versions 5.3.2 and 5.4.2.

Weaknesses

References

Community reviews

Loading reviews…