OS Command Injection Vulnerability in baserCMS by baserproject
CVE-2026-30877

9.1CRITICAL

Key Information:

Vendor

Baserproject

Status
Basercms
Vendor
CVE Published:
31 March 2026

What is CVE-2026-30877?

An OS command injection vulnerability exists in baserCMS prior to version 5.2.3. This flaw allows authenticated users with administrator privileges to execute arbitrary OS commands on the server, leveraging the privileges of the user account running baserCMS. This vulnerability poses a significant risk to server integrity and confidentiality. Users are advised to upgrade to version 5.2.3 or later to mitigate this issue.

Affected Version(s)

basercms < 5.2.3

References

https://github.com/baserproject/basercms/security/advisor...
x_refsource_CONFIRM
https://basercms.net/security/JVN_20837860
x_refsource_MISC
https://github.com/baserproject/basercms/releases/tag/5.2.3
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.