Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M
CVE-2026-30877baserCMS: OS Command Injection in the baserCMS Update Functionality
Critical 9.1
In plain English
A critical-severity OS command injection in basercms from baserproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | baserproject/basercms | 5.2.3 | GHSA-m9g7-rgfc-jcm7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| baserproject | basercms | < 5.2.3 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/baserproject/basercms/security/advisories/GHSA-m9g7-rgfc-jcm7 x_refsource_CONFIRM
- https://basercms.net/security/JVN_20837860 x_refsource_MISC
- https://github.com/baserproject/basercms/releases/tag/5.2.3 x_refsource_MISC