CVE-2026-65875

CSV Injection Vulnerability in BaserCMS Allowing Execution of Malicious Code When Opening CSV Files

Published Aug 3, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.

Analysis

Technical impact

A CSV file injection flaw exists in BaserCMS. An attacker can craft a CSV file that contains malicious code. When a user downloads and opens the file with common spreadsheet software, the injected code may be executed, potentially allowing the attacker to run arbitrary commands on the victim’s machine.

Affected Systems

The vulnerability affects BaserCMS provided by the baserCMS Users Community. No specific product versions are listed in the advisory, so any installation at the time of discovery is potentially impacted.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate risk level. EPSS information is not available and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to entice a user to download and open a malicious CSV file, making the attack vector file-based and client‑side.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

baserCMS Users Community

BaserCMS

unaffected

Version	Status	Constraints
`0`	affected	< 5.3.0

No data.

Vendor Product Versions

Basercms Users Community

Basercms

Version	Status	Scheme	Platform
`[0,5.3.0)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Acquire the latest patched release of BaserCMS that removes CSV injection.
If a fix is not yet available, avoid opening CSV files from untrusted sources or use a spreadsheet viewer that treats formulas as literal text.
Implement server‑side sanitization of CSV output, escaping leading characters such as '=' or '+' that trigger formula evaluation.

Generated by OpenCVE AI on August 3, 2026 at 09:10 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.261% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://basercms.net/security/JVN_94952030
https://jvn.jp/en/vu/JVNVU94952030/

History

Aug 3, 2026 4:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Basercms Users Community Basercms Users Community basercms
Vendors & Products		Basercms Users Community Basercms Users Community basercms

Aug 3, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 3, 2026 9:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		CSV Injection Vulnerability in BaserCMS Allowing Execution of Malicious Code When Opening CSV Files

Aug 3, 2026 12:30 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.
Weaknesses		CWE-1236
References		https://basercms.net/security/JVN_94952030 https://jvn.jp/en/vu/JVNVU94952030/
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L'}`