What is the CVSS score of CVE-2025-32957?

CVE-2025-32957 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-32957?

baserCMS versions before 5.2.3 contain a critical remote code execution vulnerability in the backup restore function that allows authenticated administrators to execute arbitrary PHP code through…. A patch is available.

How to fix or mitigate CVE-2025-32957?

Within 24 hours: inventory all baserCMS installations and identify current versions; restrict administrator backup-restore access to only essential personnel and require MFA authentication for administrative accounts. Within 7 days: upgrade to baserCMS 5.2.3 or later when available, and implement file upload validation and PHP execution restrictions in backup directories via web server configuration. Within 30 days: conduct audit of recent backup restore operations for suspicious PHP files and audit logs; implement Web Application Firewall rules to block PHP execution in backup-related directories.

PHP CVE-2025-32957

EUVD-2025-209130 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-31 GitHub_M

GHSA-hv78-cwp4-8r7r

PHP RCE File Upload

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 01:00 euvd

EUVD-2025-209130

Analysis Generated

Mar 31, 2026 - 01:00 vuln.today

CVE Published

Mar 31, 2026 - 00:43 nvd

HIGH 8.7

DescriptionGitHub Advisory

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.

AnalysisAI

Arbitrary code execution in baserCMS versions before 5.2.3 allows authenticated administrators to achieve remote code execution via malicious PHP files embedded in backup restore archives. The vulnerability exploits unsafe file inclusion during ZIP extraction in the restore function, where uploaded PHP files are executed via require_once without filename validation. No public exploit identified at time of analysis, though EPSS score of 0.00043 (0.043%) and CVSS 8.7 indicate moderate theoretical risk mitigated by high privilege requirements (PR:H).

Technical ContextAI

baserCMS is an open-source PHP-based content management system and website development framework. The vulnerability stems from a CWE-434 (Unrestricted Upload of File with Dangerous Type) weakness in the backup restoration functionality. When administrators upload ZIP archives through the restore feature, the application automatically extracts the contents and includes PHP files using require_once without implementing proper file type validation, path sanitization, or filename restrictions. This unsafe file handling pattern allows arbitrary PHP code within the archive to execute in the application context with full privileges. The affected product CPE (cpe:2.3:a:baserproject:basercms) covers all versions prior to 5.2.3, as confirmed by the GitHub security advisory GHSA-hv78-cwp4-8r7r and the vendor's security bulletin JVN_20837860.

RemediationAI

Upgrade immediately to baserCMS version 5.2.3 or later, which includes patches addressing the unsafe file inclusion vulnerability in the restore function. The patched release is available at https://github.com/baserproject/basercms/releases/tag/5.2.3 and includes validation controls preventing arbitrary PHP execution during ZIP extraction. Organizations unable to upgrade immediately should implement compensating controls including restricting restore functionality to super-administrators only, implementing file upload scanning with antivirus/malware detection, monitoring restore operations through security information and event management systems, and auditing all ZIP archives before restoration. Review administrator access logs for suspicious restore operations and consider temporarily disabling the restore feature if not operationally required. Consult the official security advisory at https://github.com/baserproject/basercms/security/advisories/GHSA-hv78-cwp4-8r7r for additional vendor guidance.