Loading vulnerability…
OS Command Injection in baserCMS Update Functionality
CVE-2026-30877 is an OS command injection vulnerability in baserCMS affecting versions prior to 5.2.3. The flaw is present in the product's update functionality and allows an authenticated administrator to supply input that results in execution of arbitrary operating system commands on the underlying server. Successful exploitation causes attacker-controlled commands to run in the security context of the account running baserCMS, creating a scope change from application-level administrative access to operating system command execution. The issue was fixed in baserCMS 5.2.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary OS command execution on the server with the privileges of the baserCMS process account. This can lead to full compromise of the application environment exposed to that account, including theft or modification of application data, deployment of persistence mechanisms, execution of follow-on tooling, and disruption of service availability. Because the flaw converts authenticated CMS administrator access into operating system-level command execution, it has high impact on confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict or temporarily disable access to the baserCMS update functionality, particularly the administrative update endpoint, through application configuration or a reverse proxy. Limit administrator access to trusted users only, reduce exposure of the administrative interface, and monitor for suspicious update-related POST requests and unexpected child processes spawned by the web application runtime. These measures are compensating controls only and do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Upgrade baserCMS to version 5.2.3 or later, which contains the vendor patch for this vulnerability. Apply the fixed release to all affected installations running versions earlier than 5.2.3.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.