baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain a stored cross-site scripting (XSS) vulnerability. This occurs because global shortcode expansion processes the entire rendered page, including HTML-escaped blog comments from unauthenticated users, allowing malicious scripts to execute in the context of site visitors or administrators. The vulnerability has been patched in versions 5.3.2 and 5.4.2.
baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain a deserialization vulnerability in the widget-area entity. This flaw allows an administrator or an attacker with widget-write capability to store malicious serialized objects via the admin JSON API. These objects are deserialized without class restrictions, enabling remote code execution as the web-server user upon unauthenticated page access after payload storage. The vulnerability has been patched in versions 5.3.2 and 5.4.2.
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containing literal ../ segments, and the view and edit actions pass it to ThemeFilesService::get() without containment validation. Authorization checks the unresolved request path, after which ThemeFile::_getContents() reads the resolved file and exposes its contents in the form textarea. A client must preserve the dot segments rather than normalize them away. Readable files are limited to .php, .css, .js, and .ctp; this can disclose application source and config/install.php database credentials in MySQL or PostgreSQL deployments, while SQLite configurations have an empty database password. Reading config/app_local.php may expose the Security.salt fallback, which is effective only when not overridden by environment configuration. The flaw does not disclose .env, .pem, or SQLite .db files, does not itself permit file writes or code execution, and does not affect the separate API getFullpath() route. The plugin is disabled by default and unauthenticated requests are not sufficient. This issue has been patched in versions 5.3.2 and 5.4.2.
baserCMS versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2 contain a path traversal vulnerability in the optional BcThemeFile plugin's Admin API. The vulnerability arises because encoded path traversal sequences are decoded after validation, allowing an authenticated administrator to write PHP files outside the intended theme directory, such as into the webroot, and execute them. Exploitation requires an administrator session, the non-default plugin enabled, and a same-origin Origin header. The issue has been patched in versions 5.3.2 and 5.4.2.
baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain an SQL injection vulnerability in the Admin and Api/Admin prefixes. Authenticated users with admin panel access can inject SQL fragments via request query parameters passed directly to the ORM, potentially allowing arbitrary SQL execution including reading password hashes. The vulnerability was patched in versions 5.3.2 and 5.4.2.
baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 have a vulnerability in the public API endpoint for mail message submissions. The API endpoint does not enforce the form's captcha verification, allowing unauthenticated attackers to automate submissions without solving the captcha challenge. This can lead to spam in administrator inboxes, attacker-influenced auto-replies, and accumulation of mail message records in the database. The issue has been patched in versions 5.3.2 and 5.4.2.
baserCMS versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2 contain an improper input validation vulnerability in public mail forms. An unauthenticated visitor can supply a comma-separated list of email addresses in the email field, causing a single auto-reply to be sent to multiple third parties. This occurs when server-side VALID_EMAIL validation is not enabled on newly created forms with email-type fields. The bundled contact form is not affected as it enables VALID_EMAIL validation by default. The issue has been fixed in versions 5.3.2 and 5.4.2.
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.
baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend.
A DOM-based cross-site scripting (XSS) vulnerability exists in baserCMS versions prior to 5.2.3 during tag creation. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of a user's browser. The issue has been addressed and patched in baserCMS version 5.2.3.
baserCMS versions prior to 5.2.3 contain a cross-site scripting (XSS) vulnerability in blog posts due to improper neutralization of input during web page generation. This vulnerability has been addressed and patched in version 5.2.3. The CVSS 4.0 base score is 6.9, indicating a medium severity level. There are no known exploits in the wild at this time.
baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.
baserCMS versions prior to 5.2.3 contain an improper authorization vulnerability in a public mail submission API. This flaw allows unauthenticated users to submit mail form entries even when the form is configured to reject submissions, bypassing administrative controls. The vulnerability enables potential spam or abuse through the API. A fix addressing this issue was released in version 5.2.3.
baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.
baserCMS versions prior to 5.2.3 contain an OS command injection vulnerability in the installer component. This vulnerability allows an attacker to execute arbitrary operating system commands due to improper neutralization of special elements. The issue has been addressed and patched in version 5.2.3. The vulnerability has a critical severity with a CVSS score of 9.2.
baserCMS versions prior to 5.2.3 contain a SQL injection vulnerability in the blog posts functionality. This vulnerability allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The issue has been addressed and patched in baserCMS version 5.2.3.
baserCMS versions prior to 5.2.3 contain a critical OS command injection vulnerability in the core update functionality. An authenticated administrator can exploit this flaw to execute arbitrary operating system commands on the server. The vulnerability arises from improper neutralization of special elements in user input passed directly to the exec() function without adequate validation or escaping. This issue has been addressed and patched in version 5.2.3.
baserCMS versions prior to 5.2.3 contain a vulnerability in the restore function that allows uploading and automatic extraction of . zip files without proper validation. A malicious PHP file inside the archive can be included via require_once, leading to arbitrary code execution. This vulnerability has been patched in version 5.2.3.