baserCMS Directory Traversal vulnerability in Form submission data management Feature

Root

Cause

The directory traversal vulnerability exists in the form submission data management feature of baserCMS prior to version 4.8.0 [1][4]. The flaw resides in the admin_attachment() method of the Mail plugin, where user-supplied path components are concatenated into a file path without proper validation [3]. The vulnerable code constructs a file path as WWW_ROOT . 'files' . DS . $settings['saveDir'] . DS . $file, allowing path traversal sequences in the $file parameter to escape the intended base directory.

Attack

Vector

An attacker must be authenticated as an administrative user of the baserCMS management console [4]. From the admin interface, the attacker can access the form submission data management feature and supply a crafted filename containing ../ sequences to navigate the filesystem. No special network position or additional privileges are required beyond valid admin credentials.

Impact

Successful exploitation allows an attacker to read arbitrary files on the server within the permissions of the web application user [1][4]. This could expose sensitive information such as configuration files, source code, or other protected data stored on the server. The vulnerability does not enable code execution or data modification directly.

Mitigation

The issue is patched in baserCMS version 4.8.0 [1][3]. The fix adds a check using realpath() to resolve the absolute path and verifies that the resulting path starts with the expected base directory, rejecting any path that escapes [3]. Users should update to the latest version; no workarounds have been published.