baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set apiBaseUrl to an attacker-controlled script URL, which is emitted as a script src and executes JavaScript on the site's origin when another visitor or administrator opens the article displaying that comment. Escaping raw HTML in comments does not prevent this stored cross-site scripting because shortcode processing happens after HTML rendering. Other registered shortcodes also expand in comments; Mail.getForm can embed a working contact form with a valid CSRF token. The flaw can compromise the authenticated browser context of an administrator who views the affected article. This issue has been patched in versions 5.3.2 and 5.4.2.
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests. Two demonstrated gadget chains in the default dependency set use composer/composer ProcessExecutor::startJob() with Process::fromShellCommandline(), or logiscape/mcp-sdk-php StdioTransport::connect() with StdioServerParameters, to reach proc_open() and execute commands as the web-server user. Deserialization bypasses constructor-based readonly safeguards, and the stored payload can execute repeatedly until the database row is repaired. Unauthenticated page access is a trigger after privileged payload storage, not an unauthenticated means of initially planting the payload. This issue has been patched in versions 5.3.2 and 5.4.2.
baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain a path traversal vulnerability in the optional BcThemeFile plugin. An authenticated user with theme-file view permission can read certain files outside the theme directory by exploiting improper path validation. This can disclose sensitive application source code and configuration files, including database credentials and security salts. The plugin is disabled by default, and unauthenticated access is not sufficient. The issue is fixed in versions 5.3.2 and 5.4.2.
baserCMS versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2 have a path traversal vulnerability in the optional BcThemeFile plugin's Admin API. This flaw allows an authenticated administrator to write and execute PHP files outside the intended theme directory by exploiting decoded path traversal sequences. Exploitation requires an administrator session, the plugin enabled, and a same-origin Origin header. The vulnerability is patched in versions 5.3.2 and 5.4.2.
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel can embed SQL fragments in those options to execute arbitrary SQL against the application's database, including reading password hashes from the users table. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not protect these administrative paths. Setting USE_CORE_ADMIN_API to false does not prevent access through an authenticated browser session. This issue has been patched in versions 5.3.2 and 5.4.2.
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_captcha setting. BcMail\Controller\Api\MailMessagesController::add() and MailMessagesService::create() omit the BcCaptchaService::check() verification of captcha_id and auth_captcha performed by MailController::submit() in the web UI. An unauthenticated attacker who can reach the API can therefore automate submissions without solving the enabled image challenge. The API disables FormProtection and has no rate limit; submissions can generate administrator-inbox spam, send attacker-influenced auto-replies to third parties when an email field is present, and accumulate mail_messages database records when save_info is enabled. The API already enforces the isAccepting() check added for CVE-2026-30878; the missing CAPTCHA check is a separate control failure. This issue has been patched in versions 5.3.2 and 5.4.2.
baserCMS versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2 have an improper input validation vulnerability in public mail forms. An unauthenticated attacker can supply a comma-separated list of email addresses in the email field, causing a single auto-reply to be sent to multiple unintended recipients. This occurs when server-side VALID_EMAIL validation is not enabled on newly created forms with email-type fields. The bundled contact form is not affected as it enables VALID_EMAIL validation by default. The vulnerability is fixed in versions 5.3.2 and 5.4.2.
baserCMS versions from 5.0.0-beta1 up to but excluding 5.3.2, and from 5.4.0 up to but excluding 5.4.2, contain a vulnerability in the PermissionGroupsService::build() method. When a plugin's config/permission.php file is missing, the system grants overly permissive access rules to non-admin groups. Specifically, the default operators group can upload and execute arbitrary PHP files under the document root after installing the BcCustomContent plugin, which lacks this config file. This allows unauthorized code execution. Versions 5.3.2 and 5.4.2 include patches that fix this issue.
A DOM-based cross-site scripting (XSS) vulnerability exists in baserCMS versions prior to 5.2.3 during tag creation. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of a user's browser. The issue has been addressed and patched in baserCMS version 5.2.3.
baserCMS versions prior to 5.2.3 contain a cross-site scripting (XSS) vulnerability in blog posts due to improper neutralization of input during web page generation. This vulnerability has been addressed and patched in version 5.2.3. The CVSS 4.0 base score is 6.9, indicating a medium severity level. There are no known exploits in the wild at this time.
baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.
baserCMS versions prior to 5.2.3 contain an improper authorization vulnerability in a public mail submission API. This flaw allows unauthenticated users to submit mail form entries even when the form is configured to reject submissions, bypassing administrative controls. The vulnerability enables potential spam or abuse through the API. A fix addressing this issue was released in version 5.2.3.
baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.
baserCMS versions prior to 5.2.3 contain an OS command injection vulnerability in the installer component. This vulnerability allows an attacker to execute arbitrary operating system commands due to improper neutralization of special elements. The issue has been addressed and patched in version 5.2.3. The vulnerability has a critical severity with a CVSS score of 9.2.
baserCMS versions prior to 5.2.3 contain a SQL injection vulnerability in the blog posts functionality. This vulnerability allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The issue has been addressed and patched in baserCMS version 5.2.3.
baserCMS versions prior to 5.2.3 contain a critical OS command injection vulnerability in the core update functionality. An authenticated administrator can exploit this flaw to execute arbitrary operating system commands on the server. The vulnerability arises from improper neutralization of special elements in user input passed directly to the exec() function without adequate validation or escaping. This issue has been addressed and patched in version 5.2.3.
baserCMS versions prior to 5.2.3 contain a vulnerability in the restore function that allows uploading and automatic extraction of . zip files without proper validation. A malicious PHP file inside the archive can be included via require_once, leading to arbitrary code execution. This vulnerability has been patched in version 5.2.3.