Arbitrary Code Execution Vulnerability in baserCMS by baserProject
CVE-2025-32957

8.7HIGH

Key Information:

Vendor

Baserproject

Status
Basercms
Vendor
CVE Published:
31 March 2026

What is CVE-2025-32957?

In baserCMS, a website development framework, the restore functionality allows users to upload ZIP files that are automatically extracted. Prior to version 5.2.3, this process permitted the inclusion of PHP files without any validation or filename restrictions. As a result, an attacker could create a malicious PHP file within the ZIP archive to execute arbitrary code during the inclusion process. This vulnerability has been addressed in the update to version 5.2.3, which implements necessary security measures.

Affected Version(s)

basercms < 5.2.3

References

https://github.com/baserproject/basercms/security/advisor...
x_refsource_CONFIRM
https://basercms.net/security/JVN_20837860
x_refsource_MISC
https://github.com/baserproject/basercms/releases/tag/5.2.3
x_refsource_MISC

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.