Log in Start free

Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M

CVE-2026-115481baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload

High 8.5

In plain English

A high-severity unrestricted file upload in basercms from baserproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High
Exploit odds (30 days)0.4%top 65.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.

Affected products (as reported)

VendorProductVersions
baserproject basercms >= 5.0.0-beta1, < 5.3.2>= 5.4.0, < 5.4.2

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References