The vulnerability arises from the baserCMS widget-area entity using PHP’s unserialize() without an allowed_classes restriction. This permits an attacker to submit a crafted string that is stored as‑is by the admin JSON API and later deserialized, enabling object injection that can reach native PHP functions such as proc_open through gadget chains. Successful exploitation allows the attacker to execute arbitrary commands on the web‑server process, leading to full remote code execution.

baserproject basercms versions 5.0.0 to 5.3.1 inclusive and 5.4.0 to 5.4.1 inclusive are vulnerable. Versions 5.3.2 and 5.4.2 or newer contain the fix.

The CVSS score is 7.2, indicating a high severity. The EPSS score is unavailable but the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to have or acquire widget‑write capability, often through privileged access or through a separate vulnerability such as chained XSS. Once the malicious payload is stored, any unauthenticated request to a page that triggers rendering of the widget area will deserialize the payload and may repeatedly execute until the database record is removed. Consequently, the risk is moderate‑high for environments where administrators or privileged users are potentially compromised or where widget area writes are accessible to untrusted parties.