CVE-2026-115479
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In baserCMS versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field, causing a single auto-reply to be addressed to multiple third parties.
Risk Assessment
An attacker can abuse the site to deliver unsolicited mail using the site's sender identity, damaging reputation and potentially leading to blacklisting.
Recommendation
Upgrade baserCMS to version 5.3.2 or 5.4.2 (or later) and enable VALID_EMAIL validation in forms.
Other vulnerabilities in baserCMS
See all- CVE-2026-97150High
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes 'config.php' from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.
- CVE-2017-10844High
baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allow an attacker to execute arbitrary PHP code on the server via unspecified vectors.
- CVE-2017-10843High
baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allow remote attackers to delete arbitrary files via unspecified vectors when the 'File' field is being used in the mail form.
- CVE-2016-4882High
CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- CVE-2016-4878High
The CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- CVE-2016-4876High
Version 3.0.10 and earlier of baserCMS contains a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators and execute arbitrary PHP code via unspecified vectors.
- CVE-2017-10842Critical
A SQL injection vulnerability in baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2026-115481High
In baserCMS, PermissionGroupsService::build() reads a plugin's config/permission.php to determine user group permissions. When that file is absent, it writes a wildcard allow rule for every non-admin group. BcCustomContent has no such file in any release, so after an administrator installs it, the default operators group can store and execute arbitrary PHP under the document root.
- CVE-2026-115480Medium
In baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public mail message API endpoint does not enforce the form's auth_captcha setting. An unauthenticated attacker can automate submissions without solving the captcha.
- CVE-2026-115457High
In baserCMS, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set apiBaseUrl to an attacker-controlled script URL, which is emitted as a script src and executes JavaScript on the site's origin when another visitor or administrator opens the article displaying that comment. Escaping raw HTML in comments does not prevent this stored cross-site scripting because shortcode processing happens after HTML rendering.
Original NVD description (English source)
baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties. MailMessageMailer::sendFormToUser() passes the visitor-controlled userMail value to parseAndNormalizeMailAddresses(), which splits it with explode(',') and supplies every resulting address to setTo(). Newly created forms with an email-type field are affected when the separate, optional VALID_EMAIL server-side validation is not enabled; browser type=email validation does not prevent crafted requests. The bundled contact form enables VALID_EMAIL and is not affected. The auto-reply uses the site's sender identity and includes partially attacker-controlled content, allowing abuse of the site to deliver unsolicited mail. This issue has been patched in versions 5.3.2 and 5.4.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS