Email Injection Vulnerability in baserCMS Framework by baserproject
CVE-2026-115479
What is CVE-2026-115479?
An email injection vulnerability exists in the baserCMS website development framework where unauthenticated visitors can exploit a public mail form's email field by inputting a comma-separated list of addresses. This could result in unsolicited emails being sent to multiple third parties due to the mishandling of the visitor-controlled 'userMail' value in the MailMessageMailer::sendFormToUser() function. If server-side 'VALID_EMAIL' validation is not enabled, crafted requests can bypass browser validations. Affected versions include 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, with the issue mitigated in later releases. To secure your application, ensure you update to versions 5.3.2 or 5.4.2.
Affected Version(s)
basercms >= 5.2.5, < 5.3.2 < 5.2.5, 5.3.2
basercms >= 5.4.0, < 5.4.2 < 5.4.0, 5.4.2