Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-21861baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)

Critical 9.1

In plain English

A critical-severity OS command injection in basercms from baserproject. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)2.3%top 16.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	baserproject/basercms	5.2.3	GHSA-qxmc-6f24-g86g

Affected products (as reported)

Vendor	Product	Versions
baserproject	basercms	< 5.2.3

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g x_refsource_CONFIRM
https://basercms.net/security/JVN_20837860 x_refsource_MISC
https://github.com/baserproject/basercms/releases/tag/5.2.3 x_refsource_MISC