Critical severity9.8NVD Advisory· Published Mar 31, 2026· Updated Apr 1, 2026

CVE-2026-30880

Description

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
baserproject/basercmsPackagist	< 5.2.3	5.2.3

Affected products

Basercms/Basercms
cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*
Range: <5.2.3

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

basercms.net/security/JVN_20837860nvdVendor AdvisoryWEB
github.com/advisories/GHSA-6hpg-8rx3-cwgvghsaADVISORY
github.com/baserproject/basercms/security/advisories/GHSA-6hpg-8rx3-cwgvnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-30880ghsaADVISORY
github.com/baserproject/basercms/releases/tag/5.2.3nvdRelease NotesWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000