High severity8.7NVD Advisory· Published Mar 31, 2026· Updated Apr 1, 2026
CVE-2025-32957
CVE-2025-32957
Description
baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
baserproject/basercmsPackagist | < 5.2.3 | 5.2.3 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/baserproject/basercms/security/advisories/GHSA-hv78-cwp4-8r7rnvdExploitVendor AdvisoryWEB
- basercms.net/security/JVN_20837860nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-hv78-cwp4-8r7rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-32957ghsaADVISORY
- github.com/baserproject/basercms/releases/tag/5.2.3nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.