Loading vulnerability…
OS Command Injection in baserCMS Core Update Functionality
CVE-2026-21861 is an OS command injection vulnerability in baserCMS affecting versions prior to 5.2.3. The flaw exists in the core update functionality, specifically in the PluginsController get_core_update() method, where user-controlled input from the update workflow is incorporated into a command string and passed to exec() without sufficient validation, escaping, or allowlisting. Because shell metacharacters are not properly neutralized, an authenticated administrator can supply crafted input that alters the intended command and causes arbitrary operating system commands to be executed on the underlying server. The issue represents a scope change from application-level administrative access to operating system command execution in the context of the web server process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary OS command execution on the server with the privileges of the web server account. This can lead to full compromise of the baserCMS instance, theft of application secrets and configuration data, modification or destruction of hosted content, deployment of server-side backdoors, and use of the compromised host as a pivot point to reach internal services accessible from that system. The assigned CVSS v3.1 vector indicates high impact to confidentiality, integrity, and availability, with changed scope because exploitation converts CMS administrative access into control over the underlying operating system context.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict or disable access to the vulnerable core update functionality, including blocking the affected administrative update endpoint at the reverse proxy or web server layer where operationally feasible. Limit administrator access to trusted users only, reduce exposure of the administrative interface, and monitor for suspicious POST requests targeting the update workflow as well as anomalous child processes spawned by the web server or PHP runtime. Hardening the execution environment of the web application and minimizing privileges of the web server account can reduce post-exploitation impact but do not eliminate the vulnerability.
Patch, then assume compromise.
Upgrade baserCMS to version 5.2.3 or later, which contains the vendor patch for this vulnerability. Review the core update functionality and ensure any command execution paths use strict input validation, allowlisting of expected values, and safe argument handling rather than direct concatenation of user-controlled input into shell commands. After patching, review administrative activity and server process history for signs of prior exploitation, and rotate any credentials or secrets that may have been exposed from the affected host.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.