baserCMS permits the BcCustomContent plugin to configure file fields that accept executable extensions such as .php. Because the plugin’s permission file is missing, the framework creates a wildcard allow rule for non‑admin groups, giving the operators group the ability to store and execute PHP files under the document root. The weakness is an insecure file upload flaw (CWE‑434). Successful exploitation lets an attacker run arbitrary PHP code on the web server, granting full control over the application and potentially the underlying operating system, and the attacker can gain this capability through any user in the operators group.

The vulnerability exists in the baserCMS framework supplied by baserproject basercms. It is present in all releases from the 5.0.0‑beta1 series up to, but not including, version 5.3.2 and 5.4.2. Versions 5.3.2 and 5.4.2 contain a patch that removes the wildcard rule and restricts file uploads. Administrators who have installed the BcCustomContent plugin on these older versions are potentially exposed.

Because the CVSS score is 8.5 the vulnerability is considered high risk, and the absence of an EPSS score means the likelihood of exploitation has not been quantified but is still possible. The flaw is not listed in the CISA KEV catalogue, indicating no confirmed public exploit at the time of reporting. Exploitation would typically require an authenticated user in the operators group or any group that receives the wildcard allow rule, but it could also be leveraged by any attacker who manages to solve the upload path or inject a PHP file through the plugin’s interface. If an attacker uploads a malicious PHP script, it will be executed in the context of the web server, providing remote code execution capabilities.