The vulnerability originates from the BcThemeFile plugin's admin screen, which allows an authenticated user with theme-file view permission to traverse outside the theme directory and read restricted files. The flaw relies on unvalidated path construction and omission of normalization, resulting in information disclosure of source code, configuration, and database credentials. This leads to a potential compromise of application secrets without granting write or execution rights.

baserproject basercms versions 5.0.0 up to 5.3.1 and 5.4.0 up to 5.4.1 are affected. Versions 5.3.2 and 5.4.2 and later contain a fix. The plugin is disabled by default and does not provide unauthenticated access.

The CVSS score of 6.5 indicates a medium severity. EPSS is not available, suggesting limited or unquantified exploitation probability. The issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with theme-file view rights, which is less privileged than full admin but still present. The attacker must maintain the dot segments in the request path to bypass normalization. If successful, the attacker can read .php, .css, .js, or .ctp files, including config/install.php and config/app_local.php, exposing database credentials and security salts. The vulnerability does not allow write or code execution, so the impact is limited to information disclosure.