baserCMS contains a flaw in its optional BcThemeFile plugin that lets an authenticated administrator perform an encoded path traversal bypass. The service validates a raw path before decoding it with rawurldecode, which skips containment checks and permits writing files outside the intended theme directory. An attacker can therefore upload PHP files to writable locations such as the webroot and execute them, resulting in remote code execution and full compromise of the affected installation. The weakness is a classic path traversal (CWE‑22) coupled with escape or encode input (CWE‑180) that leads to arbitrary file upload.

baserproject basercms versions 5.2.3 through 5.3.1 and 5.4.0 through 5.4.1 are affected. The flaw exists in the BcThemeFile plugin’s Admin API in those releases. It was fixed in 5.3.2 and 5.4.2 and newer releases.

The vulnerability scores a CVSS of 7.2, indicating high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated administrator session, the non‑default BcThemeFile plugin, and a same‑origin Origin header, but setting USE_CORE_ADMIN_API=FALSE does not block the request. Because the attack demands administrative access, the vector is local (authenticated). The high CVSS and the ability to insert exploitable PHP code warrant urgent remediation.