RCE in baserCMS before 4.1.4

HIGH 7.2CVE-2018-18942 · GHSA-rjc2-x53r-6c9r · Published 05/11/2018 · updated 17/06/2026

In short

CVE-2018-18942 is a HIGH (CVSS 7.2) vulnerability affecting baserproject/basercms, basercms (basercms).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.0% of all vulnerabilities.
Fix: update to 4.1.4 or later.

Package	Affected versions	Patched versions
baserproject/basercms Packagist	`< 4.1.4`	`4.1.4`
basercms basercms	`< 4.1.4`	`4.1.4`

Description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

NVD description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

References

nvd.nist.gov/vuln/detail/CVE-2018-18942 · ADVISORY
baserproject/basercms · WEB
web.archive.org/web/20200130073341/https://basercms.net/release/4_1_4 · WEB
web.archive.org/web/20211209034642/http://sunu11.com/2018/10/31/baserCMS · WEB
sunu11.com/2018/10/31/baserCMS · Exploit
basercms.net/release/4_1_4 · Release Notes

More vulnerabilities in baserproject/basercms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

baserproject/basercms

Packagist

< 4.1.4

4.1.4

basercms

< 4.1.4

4.1.4

Description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

NVD description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

More vulnerabilities in baserproject/basercms

See all →