The vulnerability is an OS command injection in baserCMS's core update feature that allows an authenticated administrator to execute arbitrary operating‑system commands on the hosting server. This flaw permits full compromise of the affected environment, giving the attacker complete control over data, integrity, and availability. The weakness is described by CWE‑78, reflecting unvalidated or insufficiently sanitized input passed to a system call.

The affected product is baserCMS from baserproject, version 5.2.x prior to 5.2.3. Administrators who use the built‑in update function are at risk. The vendor released patch 5.2.3 late in 2026 to address the flaw. Any installation running an earlier version is vulnerable until upgraded.

With a CVSS base score of 9.1 the vulnerability is considered critical. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog, but the nature of the bug and lack of input validation mean the exploitation path is straightforward once an attacker gains administrator credentials. The threat model assumes a web‑application context where the attacker can log in as an administrator and trigger the update process. Because of the high score and lack of mitigations, this vulnerability should be treated as a priority risk.