GitStock

baserproject/basercms · Security

baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)

GHSA ID
GHSA-hv78-cwp4-8r7r
CVE ID
CVE-2025-32957
Severity
high
Published
Updated
CVSS
8.7 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v3
8.7 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Description

Details

The application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included.

Vector: Malicious ZIP upload + insecure require_once

PoC

  1. Restore backup image
  2. Load file shell (insecure require_once) image image

Impact

Remote Code Execution (RCE)

CWEs

  • CWE-434 · Unrestricted Upload of File with Dangerous Type

References

Open GitHub