CVE-2026-115479: CWE-20: Improper Input Validation in baserproject basercms

baserCMS is affected by a CWE-20 improper input validation vulnerability in its public mail form feature. In affected versions, the MailMessageMailer::sendFormToUser() function passes a visitor-controlled userMail value to parseAndNormalizeMailAddresses(), which splits the input by commas and sends an auto-reply to each resulting address. If server-side VALID_EMAIL validation is not enabled, an attacker can supply multiple email addresses in a single field, causing the site to send unsolicited mail to multiple third parties. The vulnerability is patched in baserCMS versions 5.3.2 and 5.4.2.

An unauthenticated attacker can abuse the affected baserCMS versions to send unsolicited emails to multiple third parties by supplying multiple email addresses in a public mail form. This can lead to abuse of the site as a spam relay, potentially damaging the site's reputation and causing email deliverability issues. There is no direct confidentiality or availability impact reported.

Upgrade baserCMS to version 5.3.2 or later, or 5.4.2 or later, where this vulnerability is patched. Ensure that server-side VALID_EMAIL validation is enabled on all email-type fields in public mail forms to prevent multiple addresses from being accepted. The bundled contact form already enables VALID_EMAIL validation and is not affected.