Is there a patch available for CVE-2026-30880?

Yes, a patch is available for CVE-2026-30880. Update the affected software to the latest version immediately.

Basercms CVE-2026-30880

Q: What is the CVSS score of CVE-2026-30880?

CVE-2026-30880 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-17265 CRITICAL

OS Command Injection (CWE-78)

2026-03-31 GitHub_M

GHSA-6hpg-8rx3-cwgv

Command Injection Basercms

9.2

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 01:00 euvd

EUVD-2026-17265

Analysis Generated

Mar 31, 2026 - 01:00 vuln.today

CVE Published

Mar 31, 2026 - 00:44 nvd

CRITICAL 9.2

DescriptionGitHub Advisory

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.

AnalysisAI

OS command injection in baserCMS installer prior to version 5.2.3 allows remote attackers to execute arbitrary system commands during the installation process. The vulnerability exists in the installer component and has been patched in version 5.2.3. Attack complexity appears low given the installer context, though CVSS metrics are unavailable for detailed severity assessment.

Technical ContextAI

baserCMS is a PHP-based website development framework. The vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that user-supplied input is not properly sanitized before being passed to OS command execution functions (such as exec(), system(), or shell_exec() in PHP). The installer component fails to validate or escape special shell metacharacters, allowing an attacker to inject arbitrary commands. This is a classic command injection flaw where unsanitized input intended as data is interpreted as executable code by the shell.

RemediationAI

Vendor-released patch: baserCMS version 5.2.3 or later. Organizations running baserCMS should immediately upgrade to version 5.2.3 or newer. If upgrading is not immediately possible, restrict access to the installer to trusted networks and disable or remove the installer once initial deployment is complete. Consult the official security advisories at https://github.com/baserproject/basercms/security/advisories/GHSA-6hpg-8rx3-cwgv and https://basercms.net/security/JVN_20837860 for additional mitigation guidance.