GitHub Advisoryadvisory · Packagist

GHSA-m9g7-rgfc-jcm7 baserCMS Update Functionality Vulnerable to OS Command Injection

CRITICAL Published 2026-03-31 Modified 2026-03-31 Official page ↗
Aliases
CVE-2026-30877
Ecosystem
Packagist
Packages
baserproject/basercms
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2026-03-31

Affected packages

• Packagist baserproject/basercms: < 5.2.3 → fixed in 5.2.3

Description

Summary The latest version of baserCMS (basercms-5.2.2) contains an OS command injection vulnerability (CWE-78) in its update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. Details Please refer to the attached materials. OSコマンドインジェクション（baserCMSのアップデート機能）.pdf Impact An authenticated user with administrator privileges in baserCMS can execute OS commands on the server with the privileges of the user account running baserCMS.

Related

Alias · CVE (1)

  • CVE-2026-30877 baserCMS is a website development framework. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References