Basercms CVE-2026-30880

Remote unauthenticated attacker can exploit OS command injection during baserCMS installation phase on versions prior to 5.2.3. Requires access to the active installer interface (typically available only during initial setup or when installer files remain accessible post-deployment).

Without CVSS scores and vectors, quantitative severity assessment is limited. However, the vulnerability characteristics suggest elevated real-world risk: it is located in the installer (often run with elevated privileges during setup), involves OS command injection (CWE-78, typically high-impact), and affects all versions prior to 5.2.3. The lack of authentication requirements for installer access (typical for initial setup) likely means the attack vector is unauthenticated and network-accessible. The installer context suggests attack complexity may be low if an attacker can trigger the vulnerable code path. CISA KEV status and EPSS data are not provided; however, the availability of a vendor patch and public advisory indicates this was a known and addressed risk. Organizations running unpatched versions of baserCMS should treat this as a priority remediation target.

An attacker with network access to a baserCMS installation running the installer (version prior to 5.2.3) could craft a malicious input containing OS command metacharacters (e.g., semicolons, pipes, backticks) to be passed to a vulnerable installer parameter. Upon processing, the injected command would execute with the privileges of the web server process, potentially allowing the attacker to read sensitive files, modify the application, create backdoors, or pivot to other systems. Exploit proof-of-concept code may be available in the referenced GitHub security advisory.