Path Traversal Vulnerability in baserCMS with BcThemeFile Plugin
CVE-2026-114622
7.2HIGH
What is CVE-2026-114622?
The baserCMS framework presents a path traversal vulnerability related to the BcThemeFile plugin. This vulnerability arises when the Admin API improperly validates file paths, allowing an authenticated administrator to exploit encoded traversal sequences. This flaw can lead to the writing and execution of PHP files in unintended directories, effectively breaching the theme-template editing boundary. The issue is present in versions up to 5.2.3 and between 5.4.0 and 5.4.2, and it has been addressed in subsequent releases. Exploitation requires specific conditions including the use of the non-default BcThemeFile plugin and a valid administrator session.
Affected Version(s)
basercms >= 5.2.3, < 5.3.2 < 5.2.3, 5.3.2
basercms >= 5.4.0, < 5.4.2 < 5.4.0, 5.4.2