What is the CVSS score of CVE-2026-21861?

CVE-2026-21861 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Basercms are affected by CVE-2026-21861?

baserCMS versions prior to 5.2.3 contain a critical command injection vulnerability in the core update functionality that allows authenticated administrators to execute arbitrary system commands with…. A patch is available.

How to fix or mitigate CVE-2026-21861?

Within 24 hours: Inventory all baserCMS installations and document current versions; isolate any instances running versions prior to 5.2.3 from production traffic if possible. Within 7 days: Contact baserCMS vendor for patch availability timeline and interim guidance; implement enhanced monitoring of administrator account activity and command execution logs on affected systems. Within 30 days: Deploy baserCMS 5.2.3 or later across all affected instances; conduct audit of administrator account access logs for suspicious activity; enforce principle of least privilege for administrative roles and consider role-based access controls limiting update functionality.

Basercms CVE-2026-21861

EUVD-2026-17255 CRITICAL

OS Command Injection (CWE-78)

2026-03-31 GitHub_M

GHSA-qxmc-6f24-g86g

Command Injection Basercms

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 01:00 euvd

EUVD-2026-17255

Analysis Generated

Mar 31, 2026 - 01:00 vuln.today

CVE Published

Mar 31, 2026 - 00:43 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.

AnalysisAI

OS command injection in baserCMS core update functionality allows authenticated administrators to execute arbitrary system commands on the server. The vulnerability affects baserCMS versions prior to 5.2.3, stemming from improper sanitization of user-controlled input passed directly to exec() functions. With CVSS 9.1 (Critical) due to network accessibility, low complexity, and cross-scope impact, this represents a severe risk in multi-tenant or managed hosting environments where administrative boundaries must be enforced. EPSS data not available, no CISA KEV listing confirmed, and authentication requirements (PR:H) limit exploit surface to compromised or malicious administrator accounts.

Technical ContextAI

This vulnerability exploits the core update mechanism in baserCMS, a PHP-based website development framework maintained by the baserCMS project. The flaw is classified as CWE-78 (OS Command Injection), occurring when the application passes unsanitized administrator-supplied input directly to PHP's exec() function or similar system command execution primitives. In typical CMS architectures, update routines may accept parameters like file paths, URLs, or version identifiers that, without proper escaping or whitelisting, can be manipulated to inject shell metacharacters (semicolons, pipes, backticks) enabling arbitrary command execution. The affected CPE (cpe:2.3:a:baserproject:basercms) confirms this impacts the core baserCMS application itself rather than third-party plugins, making it a framework-level security defect affecting all installations below version 5.2.3.

RemediationAI

Upgrade immediately to baserCMS version 5.2.3 or later, which includes input validation and sanitization fixes for the command injection vulnerability in the core update functionality. The patched release is available through the official GitHub repository at github.com/baserproject/basercms/releases/tag/5.2.3. Organizations unable to upgrade immediately should implement compensating controls including restricting network access to administrative interfaces via IP whitelisting or VPN, enforcing multi-factor authentication for all administrator accounts, monitoring system logs for suspicious exec() calls or unexpected child processes spawned by web server processes, and auditing administrator account access to detect potential credential compromise. Review and rotate administrator credentials if any indication of unauthorized access exists. Detailed security guidance is published in GitHub Security Advisory GHSA-qxmc-6f24-g86g and vendor advisory at basercms.net/security/JVN_20837860.