Basercms CVE-2026-30877

Attacker must have authenticated administrator privileges in baserCMS versions prior to 5.2.3. Remote exploitation via the update functionality to execute arbitrary OS commands with baserCMS process privileges.

Real-world risk is moderate despite the critical 9.1 CVSS score. The CVSS vector reveals important constraints: network-accessible (AV:N) with low attack complexity (AC:L), but requires high privileges (PR:H) meaning administrator authentication is mandatory. The changed scope (S:C) elevates the score as command execution can impact resources beyond the application itself. No public exploit identified at time of analysis and no CISA KEV listing indicates this is not currently being actively exploited in the wild. The primary attack scenario requires either compromised administrator credentials or a malicious insider with legitimate admin access. Organizations should prioritize this based on their administrator account security posture and whether baserCMS instances are exposed to untrusted administrators. The low attack complexity means exploitation is straightforward once admin access is achieved, making this a priority for patching in environments where administrator accounts might be compromised through phishing, credential stuffing, or social engineering. Without EPSS data, historical exploitation probability cannot be quantified, but the prerequisite of admin access significantly reduces the attack surface compared to unauthenticated vulnerabilities.

An attacker who has compromised administrator credentials through phishing or credential theft authenticates to the baserCMS administrative interface. They navigate to the update functionality and inject malicious OS commands into input fields processed during the update operation, such as crafting payloads containing command separators like semicolons or backticks. Due to insufficient input validation, the injected commands execute on the server with the privileges of the web application user, potentially allowing the attacker to read sensitive files, establish persistent backdoors, pivot to other systems on the network, or exfiltrate database contents. The low attack complexity means no special conditions or race conditions are required once authenticated access is established.