An authenticated administrator can exploit a path traversal flaw in the theme file management API, allowing the creation of arbitrary files outside the intended theme directory. By inserting "../" sequences into the path parameter, an attacker can write a PHP file to any location with write permission, potentially leading to remote code execution. The weakness exemplifies a combination of directory traversal and arbitrary file write, enabling attackers to compromise the integrity of the application and its surrounding filesystem.

The issue affects baserproject basercms installations running any version before 5.2.3. Only the default theme file API endpoint ( /baser/api/admin/bc-theme-file/theme_files/add.json ) is vulnerable, and it requires a user with administrator privileges.

The CVSS score of 7.2 indicates a medium to high severity, and the EPSS score of less than 1% suggests that exploitation is currently considered unlikely. The vulnerability is not listed in CISA’s KEV catalog, so there are no widely documented exploits yet. Exploitation requires authenticated access to the admin API; once achieved, the path traversal allows the attacker to place a PHP file anywhere writable, providing a straightforward attack path to remote code execution. The impact is potentially system-wide due to the ability to write files in arbitrary locations.