What is the CVSS score of CVE-2026-30877?

CVE-2026-30877 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Basercms are affected by CVE-2026-30877?

baserCMS versions prior to 5.2.3 contain a critical command injection vulnerability in the update functionality that allows authenticated administrators to execute arbitrary commands on the hosting…. A patch is available.

How to fix or mitigate CVE-2026-30877?

Within 24 hours: Inventory all baserCMS installations and identify current versions. Within 7 days: Upgrade all baserCMS instances to version 5.2.3 or later; if immediate upgrade is not feasible, restrict administrator account access to only trusted personnel and monitor admin activity logs. Within 30 days: Conduct access reviews of all baserCMS administrator accounts and implement multi-factor authentication for admin portal access.

Basercms CVE-2026-30877

EUVD-2026-17259 CRITICAL

OS Command Injection (CWE-78)

2026-03-31 GitHub_M

GHSA-m9g7-rgfc-jcm7

Command Injection Basercms

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 01:00 euvd

EUVD-2026-17259

Analysis Generated

Mar 31, 2026 - 01:00 vuln.today

CVE Published

Mar 31, 2026 - 00:45 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.

AnalysisAI

OS command injection in baserCMS update functionality allows authenticated administrators to execute arbitrary commands on the server with application privileges. Affects baserCMS versions prior to 5.2.3. Vendor-released patch available in version 5.2.3. CVSS 9.1 reflects high impact with changed scope, though exploitation requires high-privilege administrator access (PR:H). No public exploit identified at time of analysis. EPSS data not provided, but attack complexity is low (AC:L) once admin credentials are obtained.

Technical ContextAI

The vulnerability stems from CWE-78 (OS Command Injection) in baserCMS, a PHP-based website development framework and content management system developed by the baserproject. The flaw exists in the update functionality where user-controlled input is insufficiently sanitized before being passed to system command execution functions. Based on the CPE identifier (cpe:2.3:a:baserproject:basercms), this affects the core baserCMS application. Command injection vulnerabilities typically occur when applications construct shell commands using concatenation or inadequate escaping of user input, allowing attackers to break out of intended command context and inject additional commands using metacharacters like semicolons, pipes, or backticks. In PHP applications like baserCMS, this often involves unsafe use of functions such as exec(), shell_exec(), system(), or passthru() without proper input validation.

RemediationAI

Upgrade baserCMS to version 5.2.3 immediately, which contains the vendor-released patch addressing this command injection vulnerability. The patched release is available at https://github.com/baserproject/basercms/releases/tag/5.2.3. Administrators should review access logs for suspicious update operations performed by administrator accounts prior to patching. As a defense-in-depth measure, implement the principle of least privilege by limiting the number of users with administrator-level access and enabling multi-factor authentication for all administrative accounts. Review and audit administrator account activity regularly. If immediate patching is not feasible, consider restricting network access to the baserCMS administrative interface to trusted IP addresses only and monitoring system command execution logs for anomalous activity. Consult the vendor security advisory at https://basercms.net/security/JVN_20837860 for additional guidance.