Description
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.
Published: 2026-03-31
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution
Action: Patch
AI Analysis

Impact

The flaw is an OS command injection in the baserCMS installer before version 5.2.3. An attacker who can reach the installer page can supply crafted input that will be passed directly to the operating system shell, allowing the execution of arbitrary commands. This leads to full compromise of the hosting machine, including confidentiality, integrity, and availability. The weakness corresponds to CWE‑78 and is rated CVSS 9.2.

Affected Systems

The affected product is baserCMS, a web application framework produced by the baserproject team. Versions earlier than 5.2.3 are vulnerable; the patch was released in the 5.2.3 release.

Risk and Exploitability

The CVSS score of 9.2 indicates a high‑severity risk, but the EPSS score of less than 1% suggests low current exploitation activity. The vulnerability is not listed in the CISA KEV catalog. Potential attackers would target the publicly accessible installer endpoint; the attack vector is remote via the web interface, and it requires that the installer still be operational. If it remains exposed, exploitation can occur without authentication.

Generated by OpenCVE AI on April 2, 2026 at 03:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade baserCMS to version 5.2.3 or later.
  • If an upgrade is not immediately possible, restrict access to the installer page to trusted IP addresses or remove it after installation.
  • Regularly check baserproject advisories for additional security updates.

Generated by OpenCVE AI on April 2, 2026 at 03:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-6hpg-8rx3-cwgv baserCMS has OS command injection vulnerability in installer
History

Fri, 03 Apr 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Baserproject
Baserproject basercms
Vendors & Products Baserproject
Baserproject basercms

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Basercms
Basercms basercms
CPEs cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*
Vendors & Products Basercms
Basercms basercms
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Tue, 31 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 31 Mar 2026 03:00:00 +0000

Type Values Removed Values Added
Description baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.
Title baserCMS: OS command injection vulnerability in installer
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Basercms Basercms
Baserproject Basercms
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-31T15:27:21.969Z

Reserved: 2026-03-06T00:04:56.699Z

Link: CVE-2026-30880

cve-icon Vulnrichment

Updated: 2026-03-31T15:27:09.762Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-31T01:16:36.270

Modified: 2026-04-01T20:27:00.497

Link: CVE-2026-30880

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-03T09:10:45Z

Weaknesses