baserCMS includes a public mail form that automatically replies to users. The auto‑reply logic accepts an 'email' field controlled by visitors. When a visitor supplies a comma‑separated list of addresses, the mail‑sending routine splits the string and adds each address to the list of recipients. This allows an unauthenticated user to cause the site to send a single auto‑reply to multiple third‑party addresses that the visitor controls. The reply uses the site’s sender identity and includes partially attacker‑controlled content, which can be abused to deliver unsolicited or deceptive email.

The flaw exists in baserproject basercms versions 5.2.5 through 5.3.1 and 5.4.0 through 5.4.1. The bundled contact form, which has VALID_EMAIL validation enabled, is not affected. All other mail‑form implementations that do not enable the optional VALID_EMAIL server‑side check are vulnerable.

The CVSS score of 5.3 represents a medium impact, reflecting that the flaw allows unauthenticated exploitation without privilege escalation. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable endpoint from the internet, and no special authentication is required. The result is the ability to generate bulk spam or phishing messages using the site’s domain, which may damage the website’s reputation and can be detected by mail filtering services.