baserproject/basercms · Security
baserCMS Update Functionality Vulnerable to OS Command Injection
- GHSA ID
- GHSA-m9g7-rgfc-jcm7
- CVE ID
- CVE-2026-30877
- Severity
- critical
- Published
- Updated
- CVSS
- 9.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- CVSS v3
- 9.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
Summary
The latest version of baserCMS (basercms-5.2.2) contains an OS command injection vulnerability (CWE-78) in its update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS.
Details
Please refer to the attached materials. OSコマンドインジェクション（baserCMSのアップデート機能）.pdf
Impact
An authenticated user with administrator privileges in baserCMS can execute OS commands on the server with the privileges of the user account running baserCMS.
CWEs
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')