PT-2026-103070

CVE-2026-97150

·

Published

2026-09-30

·

Updated

2026-09-30

Description by

CVSS 4.0
8.6
High
MetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions baserCMS (affected versions not specified)
Description When converting baserCMS4-style addons to baserCMS5-style ones, the BcAddonMigrator function includes the "config.php" file from the addon, leading to the execution of the PHP code contained within that file. This allows an administrative user to read or delete arbitrary files on the system.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploitability
Exploit
Researchers
Vendors
Affected products
Weakness enumeration
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Related identifiers
CVE-2026-97150
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com