CVE-2026-114624

Name of the Vulnerable Software and Affected Versions baserCMS versions 5.0.0 through 5.3.1 baserCMS versions 5.4.0 through 5.4.1

Description The admin JSON API allows strings to be stored unchanged in the widget-area entity because serialization only occurs when the submitted value is an array. When these values are read for front-end rendering or API responses, the system uses the unserialize() function without an allowed classes restriction, accepting raw and base64-encoded serialized data. An attacker with administrative privileges or widget-write access can plant an object graph that triggers during unauthenticated page requests. This can lead to remote code execution as the web-server user via proc open() through gadget chains involving composer/composer ProcessExecutor::startJob() with Process::fromShellCommandline(), or logiscape/mcp-sdk-php StdioTransport::connect() with StdioServerParameters. The deserialization process bypasses constructor-based readonly safeguards, allowing the payload to execute repeatedly.

Recommendations Update baserCMS versions 5.0.0 through 5.3.1 to version 5.3.2. Update baserCMS versions 5.4.0 through 5.4.1 to version 5.4.2.