baserCMS CVE-2026-114622

Three concrete, vendor-confirmed prerequisites must all hold: (1) the optional BcThemeFile plugin must be explicitly installed - it is in BcApp.corePlugins but NOT in BcApp.defaultInstallCorePlugins, so default installs lack it and the route returns 404; (2) a session belonging to the administrator group (BcApp.adminGroupId) is required - the route is auth=>false but PermissionsService::check() admits only admin-group members, and a normal operator gets 403 unless an administrator alters the rule; (3) a same-origin Origin header must be present because BcUtil::isSameOriginAsCurrent() returns false without one. USE_CORE_ADMIN_API can remain at its default false because BcAdminApiController::beforeFilter() admits SessionAuthenticator-backed requests (the admin SPA's mechanism) and FormProtection is disabled for Api/Admin. The Admin WEB form is NOT exploitable via this encoded-path tampering: fullpath is absent from its _Token[unlocked], so tampering fails FormProtection with HTTP 400. Net limiting factor: exploitation requires pre-existing trusted administrator access to a non-default configuration, which is why CVSS is PR:H.

This is a genuine but conditional risk, best characterized as a privilege-boundary-crossing flaw rather than a mass-exploitable internet threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:H, score 7.2) tells a consistent story: network-reachable, low complexity, no user interaction, but requiring high privileges (PR:H) - matching the advisory's confirmed precondition of an authenticated administrator session plus a same-origin Origin header. The vendor and GHSA confirm active patch availability and the mechanism; there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_week', consistent with a serious issue that is gated behind administrator access rather than an emergency. The practical ceiling on risk is threefold and all vendor-confirmed: (1) the vulnerable BcThemeFile plugin is NOT installed by default (absent from BcApp.defaultInstallCorePlugins), so default installs return 404; (2) an administrator-group session is required, and a lower-privilege operator receives 403 unless an admin changes the permission rule; (3) a same-origin Origin header is needed. The elevated impact comes from the privilege ESCALATION it enables - theme editing is intended to allow PHP template writing, but encoded traversal lets an admin write executable PHP into webroot/, config/, or anywhere the web-server user can write, exceeding the intended boundary. Note the signal nuance: a reproduction exists in the GHSA advisory showing a successful write, but there is no independent KEV/EPSS corroboration of exploitation, so treat this as a demonstrated-but-not-observed-in-the-wild issue requiring an existing trusted-admin compromise or malicious admin.

An attacker who already holds (or has phished/compromised) a baserCMS administrator session on an instance with the optional BcThemeFile plugin installed sends a crafted POST to the Admin API theme-files edit endpoint with a percent-encoded traversal path (e.g. %2e%2e%2f...) and PHP contents. Because the containment check runs on the raw value but the sink rawurldecodes it before writing, the file lands outside the theme directory (such as webroot/probe.php) and is then executed over HTTP, yielding arbitrary code execution as the web-server user. A working reproduction (curl PoC) is published in the GHSA advisory, though it is not verified as independent standalone exploit tooling; low attack complexity means the request is trivial to reproduce once admin access is held.