CVE-2026-115481GHSA-8jrp-4h7c-m679

baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload

baserproject basercms

CVSS

8.5High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.47%Chance of exploitation activity in the next 30 days, higher than 39% of CVEs. Scored 24 Oct 2026FIRST EPSS

Fixed in5.3.2Also 5.4.2GitHub

Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

5.3.2baserCMS, otherGitHub
5.4.2baserCMS, otherGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@stackflag.bsky.social: CVE-2026-115481 - basercms In certain versions of baserCMS, the BcCustomContent feature lets non‑admin users upload files with .php extensions that can be run on the web server. ThBluesky: CVE posts, 24 Oct 2026

Description

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build() reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url /baser/<prefix>/<plugin>/*, method *, auth true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default operators group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.

Text from CVE List

Affected versions 3

basercmsaffected: >= 5.0.0-beta1, < 5.3.2CVE List
basercmsaffected: >= 5.4.0, < 5.4.2CVE List
baserCMS, other<= 5.4.1GitHub