The vulnerability arises when the restore function accepts a ZIP file and extracts its contents, automatically including any PHP file inside the archive using require_once without validating the filename. Attackers can embed a malicious PHP file in the archive and achieve arbitrary code execution on the server.

The issue affects baserCMS, a website development framework produced by baserproject, and impacts all installations running any version prior to 5.2.3. Only versions 5.2.3 and later include the patch that removes the unsafe include behavior.

This flaw carries a CVSS score of 8.7, indicating high severity, and it is not listed in CISA’s KEV catalog. The exploit requires the ability to upload a file to the restore function, which is typically part of the application’s web interface; an attacker who can perform this action can execute arbitrary code on the server. The EPSS score is unavailable, so the exact likelihood of exploitation is unknown, but the high severity suggests that active monitoring and patching are urgent.