Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M
CVE-2026-30880baserCMS: OS command injection vulnerability in installer
Critical 9.2
In plain English
A critical-severity OS command injection in basercms from baserproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)2.1%top 18.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | baserproject/basercms | 5.2.3 | GHSA-6hpg-8rx3-cwgv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| baserproject | basercms | < 5.2.3 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/baserproject/basercms/security/advisories/GHSA-6hpg-8rx3-cwgv x_refsource_CONFIRM
- https://basercms.net/security/JVN_20837860 x_refsource_MISC
- https://github.com/baserproject/basercms/releases/tag/5.2.3 x_refsource_MISC