Description
BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.
Published: 2026-08-03
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A CSV file injection flaw exists in BaserCMS. An attacker can craft a CSV file that contains malicious code. When a user downloads and opens the file with common spreadsheet software, the injected code may be executed, potentially allowing the attacker to run arbitrary commands on the victim’s machine.

Affected Systems

The vulnerability affects BaserCMS provided by the baserCMS Users Community. No specific product versions are listed in the advisory, so any installation at the time of discovery is potentially impacted.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate risk level. EPSS information is not available and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to entice a user to download and open a malicious CSV file, making the attack vector file-based and client‑side.

Generated by OpenCVE AI on August 3, 2026 at 09:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Acquire the latest patched release of BaserCMS that removes CSV injection.
  • If a fix is not yet available, avoid opening CSV files from untrusted sources or use a spreadsheet viewer that treats formulas as literal text.
  • Implement server‑side sanitization of CSV output, escaping leading characters such as '=' or '+' that trigger formula evaluation.

Generated by OpenCVE AI on August 3, 2026 at 09:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Basercms Users Community
Basercms Users Community basercms
Vendors & Products Basercms Users Community
Basercms Users Community basercms

Mon, 03 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Title CSV Injection Vulnerability in BaserCMS Allowing Execution of Malicious Code When Opening CSV Files

Mon, 03 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Description BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.
Weaknesses CWE-1236
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L'}

Subscriptions

Basercms Users Community Basercms
cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-08-03T14:58:59.056Z

Reserved: 2026-07-23T09:15:44.203Z

Link: CVE-2026-65875

cve-icon Vulnrichment

Updated: 2026-08-03T14:58:53.035Z

cve-icon NVD

Status : Received

Published: 2026-08-03T01:16:45.657

Modified: 2026-08-03T16:16:30.167

Link: CVE-2026-65875

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T15:52:47Z

Weaknesses
  • CWE-1236

    Improper Neutralization of Formula Elements in a CSV File