Deserialization Vulnerability in baserCMS Affects Multiple Versions
CVE-2026-114624
What is CVE-2026-114624?
The baserCMS framework has a deserialization vulnerability affecting versions 5.0.0 through 5.3.2 and 5.4.0 before 5.4.2. A flaw in the widget-area entity allows the storage of unsanitized widget data, which can be manipulated through the admin JSON API. This opens the door for an attacker, who gains widget-write capability via other exploits, to inject crafted object graphs. The vulnerability facilitates the execution of arbitrary commands under the web server's user context through techniques that utilize the unserialize() function without restrictions on allowed classes. This results in possible unauthorized access and control, significantly compromising the integrity of the affected systems. Users are encouraged to update to versions 5.3.2 or 5.4.2, where these vulnerabilities have been patched.
Affected Version(s)
basercms >= 5.0.0, < 5.3.2 < 5.0.0, 5.3.2
basercms >= 5.4.0, < 5.4.2 < 5.4.0, 5.4.2