GitHub Advisoryadvisory · Packagist

GHSA-6hpg-8rx3-cwgv baserCMS has OS command injection vulnerability in installer

CRITICAL Published 2026-03-31 Modified 2026-03-31 Official page ↗
Aliases
CVE-2026-30880
Ecosystem
Packagist
Packages
baserproject/basercms
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-78
Reviewed
2026-03-31

Affected packages

• Packagist baserproject/basercms: < 5.2.3 → fixed in 5.2.3

Description

baserCMS has an OS command injection vulnerability in the installer. Target baserCMS 5.2.2 and earlier versions Vulnerability If baserCMS is placed on a server but not installed, malicious commands may be executed. Countermeasures Update to the latest version of baserCMS Please refer to the following page to reference for more information. https://basercms.net/security/JVN_54513170 Credits REN XINGDIAN

Related

Alias · CVE (1)

  • CVE-2026-30880 baserCMS is a website development framework. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References