Skip to main content

BaserCMS CVE-2026-65875

| EUVDEUVD-2026-52014 MEDIUM
Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
2026-08-03 jpcert GHSA-p9ff-8g3w-rccv
Code Injection Basercms
5.1
CVSS 4.0 · Vendor: jpcert
Share

Severity by source

Vendor (jpcert) PRIMARY
5.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

No authentication needed to inject data (PR:N, AV:N); victim must open the CSV (UI:R); execution escapes to spreadsheet context justifying S:C with limited C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

5
Severity Changed
Aug 03, 2026 - 01:22 NVD
HIGH MEDIUM
CVSS changed
Aug 03, 2026 - 01:22 NVD
7.1 (HIGH) 5.1 (MEDIUM)
Patch available
Aug 03, 2026 - 01:01 EUVD
Analysis Generated
Aug 03, 2026 - 00:41 vuln.today
CVE Published
Aug 03, 2026 - 00:13 cve.org
HIGH 7.1

DescriptionCVE.org

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.

AnalysisAI

CSV formula injection in BaserCMS enables a remote unauthenticated attacker to embed malicious spreadsheet formulas into user-controlled fields within the CMS. When a privileged user exports affected data as a CSV and opens it in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the injected formula executes in the context of that application on the victim's workstation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit malicious formula via public CMS input
Delivery
Formula stored in BaserCMS database
Exploit
Admin exports data as CSV file
Execution
Admin opens CSV in spreadsheet application
Persist
Spreadsheet evaluates injected formula
Impact
Arbitrary command executes on admin workstation
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must be able to submit user-controlled input to a BaserCMS form or field that is subsequently included in a CSV export - the CVSS PR:N metric confirms no authentication is required for this injection step. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 7.1 score is driven primarily by Scope:Changed (S:C), which elevates an otherwise moderate impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker submits a registration or contact form in BaserCMS containing a malicious payload such as =cmd|'/C powershell -enc <base64>'!A0 in a name or comment field. An administrator later exports a user list or submission log as CSV and opens it in Microsoft Excel. …
Remediation Consult the vendor advisory at https://basercms.net/security/JVN_94952030 and apply the patched version of BaserCMS as soon as it is identified - no specific fix version was confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all BaserCMS deployments and alert administrative staff to avoid opening CSV exports in spreadsheet software pending further guidance. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Basercms

View all
CVE-2018-18942 HIGH POC
7.2 Nov 05

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the

CVE-2017-10842 CRITICAL
9.8 Aug 29

SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arb
CVE-2023-43792 CRITICAL
9.8 Oct 30

baserCMS is a website development framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2023-43649 CRITICAL
9.8 Oct 30

baserCMS is a website development framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2023-25655 CRITICAL
9.8 Mar 23

baserCMS is a Content Management system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
CVE-2023-25654 CRITICAL
9.8 Mar 23

baserCMS is a Content Management system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
CVE-2026-30880 CRITICAL
9.2 Mar 31

OS command injection in baserCMS installer prior to version 5.2.3 allows remote attackers to execute arbitrary system co
CVE-2026-30877 CRITICAL
9.1 Mar 31

OS command injection in baserCMS update functionality allows authenticated administrators to execute arbitrary commands

CVE-2026-21861 CRITICAL
9.1 Mar 31

OS command injection in baserCMS core update functionality allows authenticated administrators to execute arbitrary syst
CVE-2017-10844 HIGH
8.8 Aug 29

baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspec
CVE-2016-4879 HIGH
8.8 May 12

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attacke
CVE-2016-4881 HIGH
8.8 May 12

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attacke

Same weakness CWE-1236 – Improper Neutralization of Formula Elements in a CSV File

View all
CVE-2019-14749 HIGH POC
8.8
CVE-2020-36962 CRITICAL POC
9.8
CVE-2023-46401 CRITICAL POC
9.8
CVE-2025-56267 CRITICAL POC
9.8
CVE-2021-47901 CRITICAL POC
9.8
CVE-2020-36941 CRITICAL POC
9.8
CVE-2022-3574 CRITICAL POC
9.8
CVE-2022-3463 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

CVE-2026-65875 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy