Path Traversal Vulnerability in baserCMS Affecting Theme File Management API
CVE-2026-30940

7.2HIGH

Key Information:

Vendor

Baserproject

Status
Basercms
Vendor
CVE Published:
31 March 2026

What is CVE-2026-30940?

A vulnerability in baserCMS's theme file management API allows authenticated administrators to exploit a path traversal flaw. By manipulating the path parameter with ../ sequences, an attacker can write arbitrary PHP files to directories outside the designated theme directory, potentially leading to remote code execution. This critical issue, affecting baserCMS versions prior to 5.2.3, has been addressed in the latest release.

Affected Version(s)

basercms < 5.2.3

References

https://github.com/baserproject/basercms/security/advisor...
x_refsource_CONFIRM
https://basercms.net/security/JVN_20837860
x_refsource_MISC
https://github.com/baserproject/basercms/releases/tag/5.2.3
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.