High severity7.2NVD Advisory· Published Mar 31, 2026· Updated Apr 1, 2026
CVE-2026-30940
CVE-2026-30940
Description
baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
baserproject/basercmsPackagist | < 5.2.3 | 5.2.3 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- github.com/baserproject/basercms/security/advisories/GHSA-c5c6-37vq-pjcqnvdExploitVendor AdvisoryWEB
- basercms.net/security/JVN_20837860nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-c5c6-37vq-pjcqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-30940ghsaADVISORY
- github.com/baserproject/basercms/releases/tag/5.2.3nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.