BaserCMS EUVD-2026-52014

The attacker must be able to submit user-controlled input to a BaserCMS form or field that is subsequently included in a CSV export - the CVSS PR:N metric confirms no authentication is required for this injection step. Exploitation is gated on two sequential actions by the victim: (1) a privileged user must perform a CSV export of the affected data, and (2) that user must open the resulting file in spreadsheet software that evaluates formula elements (Excel, LibreOffice Calc, Google Sheets). Modern Excel versions with Protected View enabled will display a warning before executing external content, requiring the user to actively click 'Enable Editing' to trigger the payload - this is a meaningful but unreliable mitigating factor. Exploitation is further limited to the permissions and context of the user who opens the CSV, and does not directly compromise BaserCMS server-side resources.

The CVSS 7.1 score is driven primarily by Scope:Changed (S:C), which elevates an otherwise moderate impact. The vector AV:N/AC:L/PR:N/UI:R confirms network-accessible, low-complexity delivery with no authentication barrier for the injection phase, but requires the victim to actively open the exported CSV file. EPSS data was not provided, limiting probabilistic exploitation forecasting. KEV status is not confirmed, and no public POC exploit has been identified, suggesting this is not yet under active mass exploitation. Real-world risk is moderate: the attack is opportunistic against administrators who routinely export CMS data, making it a viable spear-phishing or insider-threat vector. Modern versions of Excel default to Protected View for downloaded files, which partially mitigates automatic formula execution, though user override of Protected View warnings is common. The absence of a bounded version range in the CPE is a data gap - the true exposure scope depends on how many BaserCMS deployments remain unpatched.

An unauthenticated attacker submits a registration or contact form in BaserCMS containing a malicious payload such as =cmd|'/C powershell -enc <base64>'!A0 in a name or comment field. An administrator later exports a user list or submission log as CSV and opens it in Microsoft Excel. If Protected View is dismissed or disabled, Excel evaluates the formula and executes the embedded command on the administrator's workstation under their user context.