baserCMS CVE-2026-114623

Exploitation requires: (1) the optional BcThemeFile (bc-theme-file) plugin to be enabled - it is disabled by default but is a bundled core plugin enabled with one click from the admin UI; (2) an authenticated admin-panel account holding the theme-file VIEW permission (edit permission is NOT required, and view-only non-admin accounts suffice, which is the privilege-escalation core of this issue); and (3) a client that preserves the literal ../ dot segments rather than normalizing them - i.e. a raw HTTP client such as Burp Repeater or curl --path-as-is, since browser address bars and form actions strip them. Exploitation is bounded: only .php, .css, .js, and .ctp files are readable; .env, .pem, and SQLite .db files are not disclosed; SQLite deployments have an empty database password so credential theft is meaningful mainly for MySQL/PostgreSQL; and the config/app_local.php Security.salt is only useful when not overridden by environment configuration. The flaw does not permit file writes or code execution and does not affect the separate API getFullpath() route.

This is a genuine but moderate, condition-gated issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) is internally consistent with the description: network-reachable admin web screen, low-privileged authenticated access, no user interaction, and high confidentiality impact (source and plaintext DB credentials) with no integrity or availability impact. Several escalation signals are ABSENT from the input: no EPSS probability was provided, and the CVE is NOT listed in CISA KEV, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month', signalling a scheduled priority rather than act_now/emergency. Offsetting the risk, the GHSA advisory includes concrete PoC HTTP requests, so exploitation is well-understood and low-effort for anyone who already holds an account. The strongest limiting factors are that the BcThemeFile plugin is disabled by default (though it is a bundled core plugin enabled with one admin click) and that an authenticated account with theme-file view permission is required - exploitation is therefore privilege-escalation from a low-trust internal user, not anonymous internet exploitation. Net: a real priority for operators who have enabled BcThemeFile and provision non-admin theme users, but low real-world risk for default deployments.

A low-privileged authenticated user who has been granted only the theme-file view permission uses a raw HTTP client (Burp Repeater or curl --path-as-is, because browsers normalize the dot segments) to request the view/edit action with literal ../ segments preserved, escaping the theme directory. The server authorizes the unresolved request path, then reads and renders config/install.php into the form textarea, disclosing plaintext MySQL or PostgreSQL database credentials. The GHSA advisory contains working PoC request examples demonstrating this against baserCMS 5.4.1.