GitHub Advisoryadvisory · Packagist

GHSA-hv78-cwp4-8r7r baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)

HIGH Published 2026-03-31 Modified 2026-03-31 Official page ↗
Aliases
CVE-2025-32957
Ecosystem
Packagist
Packages
baserproject/basercms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-434
Reviewed
2026-03-31

Affected packages

• Packagist baserproject/basercms: < 5.2.3 → fixed in 5.2.3

Description

Details The application's restore function allows users to upload a `.zip` file, which is then automatically extracted. A PHP file inside the archive is included using `require_once` without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. Vector: Malicious ZIP upload + insecure `require_once` PoC 1. Restore backup 1. Load file shell (insecure `require_once`) Impact Remote Code Execution (RCE)

Related

Alias · CVE (1)

  • CVE-2025-32957 baserCMS is a website development framework. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References