BcAddonMigrator EUVD-2026-89656

Requires an authenticated administrative user (PR:H) with access to the addon-migration feature and the ability to supply a baserCMS4-style addon package containing an attacker-controlled config.php. Exploitation is limited to the specific code path that converts baserCMS4-style addons to baserCMS5-style ones (BcAddonMigrator5Component::migrateAddonConfig), which performs include on the uploaded config.php; systems not using BcAddonMigrator (≤5.2.0) or not performing such a migration are unaffected. No end-user interaction beyond the admin action is required (UI:N), and the attack is over the network (AV:N), but the admin-privilege requirement is the dominant limiting factor.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6, but the single most important limiting signal is PR:H - exploitation requires an already-authenticated administrative user, which the description confirms ('by an administrative user'). This makes it a post-authentication code-execution flaw rather than a mass-exploitable perimeter bug. The CWE-829 classification and the patch diff are decisive: the vulnerable code did include $path on an addon's config.php, so any PHP in that file executes during baserCMS4→5 migration. The description's phrasing ('files may be read or deleted') understates the true impact - the source evidence shows arbitrary PHP execution (RCE), which is consistent with the VC:H/VI:H/VA:H and the 'RCE' tag. No EPSS score, no CISA KEV listing, and no public exploit code are provided, so there is no evidence of active exploitation; this is a real but bounded issue whose priority is capped by the admin-privilege prerequisite and the narrow, niche product footprint. Net: legitimate defense-in-depth fix (a trusted admin is normally expected to run trusted code, but this breaks the assumption that uploaded addons are inert config), but not an emergency for most environments given PR:H and low prevalence.

An authenticated baserCMS administrator (or an attacker who has phished/compromised an admin account) obtains access to the addon-migration feature, uploads a baserCMS4-style addon ZIP containing a crafted config.php with embedded PHP payload, and triggers the baserCMS4→5 conversion. BcAddonMigrator's include $path executes the attacker's PHP with web-server privileges, allowing arbitrary file read/deletion and code execution. No public exploit code is identified at time of analysis, though the fix commit publicly reveals the exact vulnerable code path.