baserCMS Update Flaw Allowed Authenticated Admin Command Execution
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 31, 2026
baserCMS disclosed and patched an OS command injection vulnerability in its update functionality that allowed an authenticated administrator to execute arbitrary operating system commands on the underlying server. The issue, tracked as CVE-2026-30877 and CVE-2026-21861, affects baserCMS versions prior to 5.2.3 and stems from insufficient validation of user-controlled input passed to the update process, including unsafe handling around exec().
The vulnerability is classified as CWE-78 and carries a CVSS v3.1 vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, reflecting high impact to confidentiality, integrity, and availability despite requiring administrator privileges. baserCMS addressed the flaw in version 5.2.3, with public references including the vendor security notice, the 5.2.3 release information, and a GitHub security advisory.
