GHSA-hv78-cwp4-8r7rHighCVSS 8.7

baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)

Published
March 31, 2026
Last Modified
March 31, 2026

🔗 CVE IDs covered (1)

CVE-2025-32957 →

📋 Description

Details

The application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included.

Vector: Malicious ZIP upload + insecure require_once

PoC

  1. Restore backup image
  2. Load file shell (insecure require_once) image image

Impact

Remote Code Execution (RCE)

🎯 Affected products1

  • composer/baserproject/basercms:<= 5.2.2

🔗 References (5)