PT-2026-29152

CVE-2026-30940

Publicado

2026-03-31

Atualizado

2026-10-23

Descrição por

CVSS 3.1

7.2

Alta

MétricasAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions baserCMS versions prior to 5.2.3

Description baserCMS is a website development framework. A path traversal flaw exists in the theme file management API, specifically at the ''/baser/api/admin/bc-theme-file/theme files/add.json'' endpoint. An authenticated administrator can manipulate the path parameter using '..' sequences to create PHP files in locations outside the intended theme directory. This could lead to remote code execution (RCE). The vulnerable parameter is the path parameter.

Recommendations Update to version 5.2.3 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Kaminuma

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

CWE-73: External Control of File Name or Path