CVE-2026-21861: baserCMS Remote Code Execution via OS Command Injection
Summary
CVE-2026-21861: baserCMS has OS Command Injection Leading to Remote Code Execution (RCE). Affects baserproject/basercms versions < 5.2.3. Fixed in 5.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
baserCMS is an open-source content management system (CMS) designed to facilitate the creation and management of websites. It provides a user-friendly interface for administrators to manage content, plugins, and updates. However, a critical vulnerability has been identified in its core update functionality, which allows an authenticated administrator to execute arbitrary OS commands on the server, leading to potential remote code execution (RCE). This vulnerability arises from improper handling of user input, specifically in the parameters passed to the exec() function.
Vulnerability Detail
The vulnerability in baserCMS stems from the core update functionality where user input is directly passed to the exec() function without proper validation or escaping. This design flaw allows an authenticated CMS administrator to execute arbitrary OS commands on the server, leading to remote code execution (RCE). The affected code retrieves parameters from POST data and concatenates them into a command string, which is then executed. This issue is critical as it can lead to unauthorized access to server information, reading or writing arbitrary files, and executing OS-level operations beyond application permission boundaries.
How To Fix
Minimum fixed version
5.2.3
This is the first release that contains the fix.
composer require baserproject/basercms:5.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the PHP executable path by implementing an allowlist validation. However, this is not recommended as a long-term solution. The best practice is to eliminate user input entirely for the PHP executable path.
Conclusion
CVE-2026-21861 represents a significant security risk for baserCMS installations, allowing remote code execution through improper handling of user input in the core update functionality. It is crucial to update to version 5.2.3 or later to mitigate this vulnerability and ensure the security of your application.
See every vulnerability recorded for baserproject/basercms →
FAQ
CVE-2026-21861 is a critical vulnerability in baserCMS that allows authenticated administrators to execute arbitrary OS commands on the server, leading to remote code execution.
Any installation of baserCMS version 5.2.2 or earlier is affected by this vulnerability, specifically those with administrator access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2026-21861 is 9.1, indicating a critical severity level.
If you cannot update to the patched version immediately, implement the recommended workaround by restricting the PHP executable path and avoid passing user input to the exec() function.
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
