CVE-2026-30940 is a path traversal vulnerability (CWE-22) in baserCMS's theme file management API endpoint (/baser/api/admin/bc-theme-file/theme_files/add.json) present in versions before 5.2.3. An authenticated administrator can exploit this by including '../' sequences in the path parameter to write PHP files outside the theme directory, potentially enabling remote code execution. This vulnerability has been patched in baserCMS version 5.2.3.

Successful exploitation allows an authenticated administrator to write arbitrary PHP files outside the intended directory, which may lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The CVSS score is 7.2 (high severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade baserCMS to version 5.2.3 or later, where this vulnerability has been patched. No other mitigation is indicated or required as the fix is official and addresses the issue directly.