baserCMS EUVD-2026-108995

Initial payload planting requires widget-write access to the baserCMS admin JSON API - i.e. an authenticated administrator, or an attacker who has separately obtained widget-write capability (the advisory cites chained XSS) - which is why this is PR:H and not unauthenticated. The specific triggering quirk is that the widget-area entity only serializes the 'widgets' value when it is an array, so submitting a string through the JSON-typed API bypasses serialization and writes raw attacker bytes to the column. Exploitation further requires that the default dependency set is present (composer/composer as a production dependency, and/or logiscape/mcp-sdk-php shipped via the bc-mcp core plugin) so a gadget chain reaching proc_open() exists. Once stored, the deserialization fires on every widget-area render - including unauthenticated public page loads - and re-executes on each request until the database row is repaired. Limiting factors: the privileged write precondition, dependence on the vulnerable version ranges (5.0.0-5.3.1, 5.4.0-5.4.1), and availability of a usable gadget class in the autoloader.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) is internally consistent with the description: exploitation reaches the vulnerable mutator over the network through the admin JSON API, but requires high privileges (PR:H) because only an administrator - or an attacker who has already obtained widget-write capability through a separate flaw such as chained XSS - can plant the payload. The frequently-cited 'unauthenticated RMCE' framing in the advisory summary is nuanced by the description itself, which states explicitly that unauthenticated page access is only the trigger for a payload that must first be stored with privileged access, not an unauthenticated means of initial planting - this is the single most important signal for prioritization and prevents overrating the flaw as PR:N. No EPSS score, no CISA KEV listing, and no SSVC machine-readable decision were provided in the input, so probabilistic and active-exploitation signals are absent; the only priority signal is the vuln.today Decision label 'this_week'. The vendor advisory (GHSA-xf6p-r2hc-cc6w) documents two fully worked gadget chains with confirmed command execution as the web-server user, which materially raises practical exploitability for anyone who can meet the privileged-write precondition. Net assessment: a genuine high-severity RCE for environments where admin accounts or a chained XSS write primitive are reachable, but not a drop-everything mass-exploitation event given PR:H and the niche product footprint; the 'this_week' label is a reasonable match.

An attacker who already controls a baserCMS admin session (or who has chained a separate XSS to gain widget-write capability) submits a crafted serialized PHP object graph as a string value for the widget-area 'widgets' field through the admin JSON API, where it is stored unchanged. On the next page render - including unauthenticated front-end requests - the stored value is passed to unserialize() without allowed_classes, instantiating a gadget chain (composer/composer ProcessExecutor or logiscape/mcp-sdk-php StdioTransport) that reaches proc_open() and runs arbitrary commands as the web-server user. The vendor advisory provides two confirmed proof-of-concept object graphs (1256 and 1374 bytes) demonstrating command execution; these are PoC references in the advisory, not verified as packaged standalone exploit code.