CVE-2026-30940

HIGH

7.2

Description

baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.

CVE Details

CVSS v3.1 Score7.2

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published3/31/2026

Last Modified4/1/2026

Sourcenvd

Honeypot Sightings0

Affected Products

basercms:basercms

Weaknesses (CWE)

CWE-22CWE-73CWE-22

References

https://basercms.net/security/JVN_20837860(security-advisories@github.com)

https://github.com/baserproject/basercms/releases/tag/5.2.3(security-advisories@github.com)

https://github.com/baserproject/basercms/security/advisories/GHSA-c5c6-37vq-pjcq(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.