Path Traversal Vulnerability in baserCMS by baserproject
CVE-2026-114623

6.5MEDIUM

Key Information:

Vendor

Baserproject

Status
Basercms
Vendor
CVE Published:
23 October 2026

What is CVE-2026-114623?

An issue in baserCMS allows authenticated users with only theme-file view permission to traverse outside the theme directory via the BcThemeFile plugin. The vulnerability arises from improper handling of file paths in ThemeFilesController::parseArgs(), allowing exploitation through unresolved path requests. This can lead to exposure of sensitive files, including application source code and database credentials, particularly in MySQL or PostgreSQL deployments. The plugin is disabled by default, mitigating unauthenticated access. The flaw has been patched in versions 5.3.2 and 5.4.2, ensuring enhanced security for users.

Affected Version(s)

basercms >= 5.0.0, < 5.3.2 < 5.0.0, 5.3.2

basercms >= 5.4.0, < 5.4.2 < 5.4.0, 5.4.2

References

https://github.com/baserproject/basercms/security/advisor...
x_refsource_CONFIRM
https://github.com/baserproject/basercms/commit/53ecf177d...
x_refsource_MISC
https://github.com/baserproject/basercms/commit/9bc50d7a4...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.