baserCMS BcCustomContent lets operators upload executable PHP files
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
baserCMS from 5.0.0-beta1 before 5.3.2 and from 5.4.0 before 5.4.2 is affected. When a plugin has no config/permission.php, PermissionGroupsService::build() grants non-admin groups a wildcard allow rule, and BcCustomContent ships no such file. After an administrator installs BcCustomContent, a user in the default operators group can upload and execute arbitrary PHP files under the document root, a missing file type restriction (CWE-434).
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| baserproject | basercms | 5.0.0-beta1 to before 5.3.2; 5.4.0 to before 5.4.2 | 5.3.2, 5.4.2 | Patch available | CNA |
- basercms Vendorbaserproject Affected 5.0.0-beta1 to before 5.3.2; 5.4.0 to before 5.4.2 Fixed in 5.3.2, 5.4.2 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* | — | — | baserproject |
- cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* Versions — — ·baserproject
Remediation
Upgrade baserCMS to version 5.3.2 or 5.4.2, whichever matches the release you run.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA basercms (baserproject) Fixed in 5.3.2, 5.4.2
Timeline
- 2026-10-23 Threatist record created from CVE-2026-115481
- 2026-10-23 CISA SSVC decision points changed
- 2026-10-23 Priority changed: MEDIUM → LOW
References
Other 5
- https://github.com/baserproject/basercms/security/advisories/GHSA-8jrp-4h7c-m679
- https://github.com/baserproject/basercms/commit/2ed19c878add5c26fc765572e0e77173c1f1fdb5
- https://github.com/baserproject/basercms/commit/b0ef31b10dc6267b48ebc9a80d34bc7c4c09c311
- https://github.com/baserproject/basercms/releases/tag/5.3.2
- https://github.com/baserproject/basercms/releases/tag/5.4.2
More baserproject vulnerabilities
- TI-2026-53549 baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php CVSS 4.0HIGH 8.6
- TI-2026-17563 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.1
- TI-2025-23967 baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) CVSS 3.1HIGH 8.7
- TI-2026-79890 PHP object injection in baserCMS widget-area entity CVSS 3.1HIGH 7.2
- TI-2026-79888 baserCMS: Encoded path traversal bypass in the theme file API CVSS 3.1HIGH 7.2
- TI-2026-79891 Stored cross-site scripting in baserCMS via blog comment shortcodes CVSS 3.1HIGH 7.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences