CVE-2026-30877: baserCMS OS Command Injection Vulnerability
Summary
CVE-2026-30877: baserCMS Update Functionality Vulnerable to OS Command Injection. Affects baserproject/basercms versions < 5.2.3. Fixed in 5.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
baserCMS is an open-source content management system (CMS) designed for building and managing websites. It provides a user-friendly interface, customizable templates, and various plugins to enhance functionality. However, the latest version (5.2.2) has been found to contain a critical OS command injection vulnerability that can be exploited by authenticated users with administrator privileges.
Vulnerability Detail
The vulnerability arises from improper validation in the update functionality of baserCMS, allowing authenticated users with administrator access to execute arbitrary OS commands on the server. This can lead to severe consequences, including unauthorized access to sensitive data, server compromise, and potential data loss. The vulnerability is classified under CWE-78, indicating a command injection flaw.
How To Fix
Minimum fixed version
5.2.3
This is the first release that contains the fix.
composer require baserproject/basercms:5.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the baserCMS admin panel to trusted IP addresses only. This can help mitigate the risk of exploitation until the update is applied.
Conclusion
The OS command injection vulnerability in baserCMS (CVE-2026-30877) poses a significant risk to users with administrator privileges. It is crucial to update to version 5.2.3 or later to protect against potential exploitation. Implementing temporary workarounds can also help mitigate risks until the update is completed.
See every vulnerability recorded for baserproject/basercms →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
Any authenticated user with administrator privileges in baserCMS version 5.2.2 or earlier is affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized execution of OS commands, compromising server security, and potential data breaches.
Yes, restricting access to the admin panel to trusted IP addresses can help mitigate the risk until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
