baserCMS a PHP‑based website framework that includes a restore feature allowing users to upload ZIP archives. Prior to version 5.2.3, the restore process automatically extracts the archive and then inclusively requires any PHP file found inside. An attacker can embed a malicious PHP script within a crafted ZIP package so that it is executed when the archive is restored, resulting in arbitrary code execution on the web server. This vulnerability is categorized as a file‑upload flaw (CWE‑434).

The affected product is baserCMS from baserproject. Any installation running a version before 5.2.3 is vulnerable. The flaw was addressed in the 5.2.3 release and later versions are considered safe.

The score of 8.7 under CVSS denotes high severity, while the EPSS value of less than 1 % suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the flaw by uploading a crafted ZIP file through the web interface's restore function. If the vulnerability is exploited, the attacker could gain full control over the application server, compromising confidentiality, integrity, and availability of the hosted services.