Arbitrary PHP Execution in baserCMS Versions Prior to 5.3.2 and 5.4.2
CVE-2026-115481
8.5HIGH
What is CVE-2026-115481?
A vulnerability exists in baserCMS where the PermissionGroupsService::build() function improperly handles the absence of a plugin's config/permission.php file. As a result, it defaults to granting broad access rules to non-admin user groups, potentially allowing malicious users to store and execute arbitrary PHP code. This flaw affects baserCMS versions up to 5.2.x, but has been resolved in subsequent releases 5.3.2 and 5.4.2, which implement proper permission checks and restrict unauthorized code execution.
Affected Version(s)
basercms >= 5.0.0-beta1, < 5.3.2 < 5.0.0-beta1, 5.3.2
basercms >= 5.4.0, < 5.4.2 < 5.4.0, 5.4.2