CVE-2026-114623

Name of the Vulnerable Software and Affected Versions baserCMS versions 5.0.0 through 5.3.1 baserCMS versions 5.4.0 through 5.4.1

Description An authenticated user with theme-file view permissions can perform a directory traversal attack via the Admin web screen of the optional BcThemeFile plugin. The ThemeFilesController::parseArgs() function creates a path containing ../ segments, which is then passed to ThemeFilesService::get() without proper containment validation. Subsequently, ThemeFile:: getContents() reads the resolved file and displays its contents in a textarea. This allows the disclosure of files with .php, .css, .js, and .ctp extensions, potentially exposing application source code and database credentials in config/install.php for MySQL or PostgreSQL, or the Security.salt fallback in config/app local.php. The issue requires the client to preserve dot segments and does not allow file writes, code execution, or access to .env, .pem, and .db files.

Recommendations Update baserCMS versions 5.0.0 through 5.3.1 to version 5.3.2. Update baserCMS versions 5.4.0 through 5.4.1 to version 5.4.2. As a temporary workaround, disable the BcThemeFile plugin.