Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-30940baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE

High 7.2

In plain English

A high-severity path traversal in basercms from baserproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.1%top 35.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	baserproject/basercms	5.2.3	GHSA-c5c6-37vq-pjcq

Affected products (as reported)

Vendor	Product	Versions
baserproject	basercms	< 5.2.3

Weakness: CWE-22, CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/baserproject/basercms/security/advisories/GHSA-c5c6-37vq-pjcq x_refsource_CONFIRM
https://basercms.net/security/JVN_20837860 x_refsource_MISC
https://github.com/baserproject/basercms/releases/tag/5.2.3 x_refsource_MISC