CVE-2026-115481 Details
Description
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.
A vulnerability in the BcCustomContent plugin for baserCMS allows users in the 'operators' group to upload and execute arbitrary PHP files, leading to remote code execution. This issue arises because the plugin's permission configuration file is missing, causing the application to default to a permissive rule that grants full access to non-admin user groups. Exploitation involves uploading a PHP file through a custom field, which is then executed on the server.
Users can update to baserCMS versions 5.3.2 or 5.4.2, both of which address this vulnerability by implementing checks that prevent the upload of executable file types. Instructions for updating can be found in the baserCMS documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/baserproject/basercms/commit/2ed19c878add5c26fc765572e0e77173c1f1fdb5 | [email protected] | Source CodeVendor |
| https://github.com/baserproject/basercms/commit/b0ef31b10dc6267b48ebc9a80d34bc7c4c09c311 | [email protected] | Source CodeVendor |
| https://github.com/baserproject/basercms/releases/tag/5.3.2 | [email protected] | Release NotesVendor |
| https://github.com/baserproject/basercms/releases/tag/5.4.2 | [email protected] | Release NotesVendor |
| https://github.com/baserproject/basercms/security/advisories/GHSA-8jrp-4h7c-m679 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| baserCMS | <= 5.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |