baserCMS Users Community vulnerabilities and threats

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

BaserCMS, a content management system by baserCMS Users Community, has a CSV file injection vulnerability. This flaw allows malicious code to be injected into CSV files generated by the system. When a user downloads and opens such a CSV file, the embedded malicious code may be executed, potentially leading to data confidentiality, integrity, and availability impacts.