CVE-2026-30880: baserCMS OS Command Injection Vulnerability in Installer
Summary
CVE-2026-30880: baserCMS has OS command injection vulnerability in installer. Affects baserproject/basercms versions < 5.2.3. Fixed in 5.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
baserCMS is an open-source content management system (CMS) designed for building and managing websites. It offers a user-friendly interface, customizable templates, and various plugins to enhance functionality. However, versions 5.2.2 and earlier are vulnerable to an OS command injection flaw in the installer, which can lead to severe security risks if not addressed.
Vulnerability Detail
The OS command injection vulnerability in baserCMS arises when the software is installed on a server but not fully configured. This flaw allows an attacker to execute arbitrary commands on the server, potentially leading to unauthorized access, data breaches, or complete system compromise. The vulnerability is classified under CWE-78, indicating a command injection issue that can be exploited without proper input validation.
How To Fix
Minimum fixed version
5.2.3
This is the first release that contains the fix.
composer require baserproject/basercms:5.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, ensure that baserCMS is not publicly accessible until it is properly installed and configured. Additionally, consider implementing firewall rules to restrict access to the installer directory.
Conclusion
The OS command injection vulnerability in baserCMS poses a significant risk to users of versions 5.2.2 and earlier. It is crucial to update to version 5.2.3 or later to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for baserproject/basercms →
FAQ
baserCMS is an open-source content management system that allows users to create and manage websites easily.
OS command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a server, potentially compromising the system.
You can check your version of baserCMS against the affected versions (5.2.2 and earlier) to determine if you are at risk.
The CVSS score for this vulnerability is 9.2, indicating a critical level of severity.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file, providing real-time updates without needing access to the code.
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
