CVE-2026-30879: baserCMS Cross-Site Scripting Vulnerability in Blog Posts
Summary
CVE-2026-30879: baserCMS has a cross-site scripting vulnerability in blog posts. Affects baserproject/basercms versions < 5.2.3. Fixed in 5.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
baserCMS is an open-source content management system (CMS) designed for building and managing websites. It provides users with a flexible framework for creating blog posts, pages, and other content types. The system is widely used for its ease of use and extensibility. However, versions 5.2.1 and earlier are vulnerable to a cross-site scripting (XSS) issue that allows attackers to inject malicious JavaScript into blog posts, potentially compromising user data and site integrity.
Vulnerability Detail
The vulnerability arises from improper handling of user input in blog posts, allowing attackers to embed malicious JavaScript code. When users view the affected blog posts, the malicious script executes in their browsers, which can lead to session hijacking, data theft, or redirecting users to malicious sites. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).
How To Fix
Minimum fixed version
5.2.3
This is the first release that contains the fix.
composer require baserproject/basercms:5.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update immediately, consider sanitizing user input on your blog posts to prevent the execution of JavaScript. This can be done by using libraries that escape HTML characters or by implementing a content security policy (CSP) that restricts script execution.
Conclusion
In summary, baserCMS versions 5.2.1 and earlier are vulnerable to a cross-site scripting issue that can lead to serious security risks. It is crucial to update to version 5.2.3 or later to protect your application and users from potential attacks. Additionally, utilizing tools like Vulert can help monitor and alert you to open-source vulnerabilities in your software.
See every vulnerability recorded for baserproject/basercms →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate level of risk.
baserCMS versions 5.2.1 and earlier are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include session hijacking, data theft, and redirecting users to malicious sites.
Yes, you can sanitize user input and implement a content security policy (CSP) to mitigate the risk until you can update.
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
