CVE-2026-114623
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
In baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin. This can disclose application source and database credentials in config/install.php.
Risk Assessment
An attacker can read database credentials and the security salt, potentially leading to further compromise of the application.
Recommendation
Upgrade baserCMS to version 5.3.2 or 5.4.2 (or later) and restrict theme-file view permissions.
Other vulnerabilities in baserCMS
See all- CVE-2026-97150High
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes 'config.php' from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.
- CVE-2017-10844High
baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allow an attacker to execute arbitrary PHP code on the server via unspecified vectors.
- CVE-2017-10843High
baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allow remote attackers to delete arbitrary files via unspecified vectors when the 'File' field is being used in the mail form.
- CVE-2016-4882High
CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- CVE-2016-4878High
The CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- CVE-2016-4876High
Version 3.0.10 and earlier of baserCMS contains a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators and execute arbitrary PHP code via unspecified vectors.
- CVE-2017-10842Critical
A SQL injection vulnerability in baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2026-115481High
In baserCMS, PermissionGroupsService::build() reads a plugin's config/permission.php to determine user group permissions. When that file is absent, it writes a wildcard allow rule for every non-admin group. BcCustomContent has no such file in any release, so after an administrator installs it, the default operators group can store and execute arbitrary PHP under the document root.
- CVE-2026-115480Medium
In baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public mail message API endpoint does not enforce the form's auth_captcha setting. An unauthenticated attacker can automate submissions without solving the captcha.
- CVE-2026-115479Medium
In baserCMS versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field, causing a single auto-reply to be addressed to multiple third parties.
Original NVD description (English source)
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containing literal ../ segments, and the view and edit actions pass it to ThemeFilesService::get() without containment validation. Authorization checks the unresolved request path, after which ThemeFile::_getContents() reads the resolved file and exposes its contents in the form textarea. A client must preserve the dot segments rather than normalize them away. Readable files are limited to .php, .css, .js, and .ctp; this can disclose application source and config/install.php database credentials in MySQL or PostgreSQL deployments, while SQLite configurations have an empty database password. Reading config/app_local.php may expose the Security.salt fallback, which is effective only when not overridden by environment configuration. The flaw does not disclose .env, .pem, or SQLite .db files, does not itself permit file writes or code execution, and does not affect the separate API getFullpath() route. The plugin is disabled by default and unauthenticated requests are not sufficient. This issue has been patched in versions 5.3.2 and 5.4.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS