Edit template, Remote Code Execution (RCE) Vulnerability in Latest Release 4.4.0

HIGH 7.2CVE-2020-15277 · GHSA-6fmv-q269-55cw · Published 30/10/2020 · updated 17/06/2026

In short

CVE-2020-15277 is a HIGH (CVSS 7.2) vulnerability affecting baserproject/basercms, basercms (basercms).
Chance of exploitation in the next 30 days (EPSS): 2.3%, higher than 83.4% of all vulnerabilities.
Fix: update to 4.4.1 or later.

Package	Affected versions	Patched versions
baserproject/basercms Packagist	`≥ 4.4.0, < 4.4.1`	`4.4.1`
basercms basercms	`≥ 4.0.0, < 4.4.1`	`4.4.1`

Description

baserCMS 4.4.0 and earlier is affected by Remote Code Execution (RCE).

Impact: XSS via Arbitrary script execution. Attack vector is: Administrator must be logged in. Components are: Edit template. Tested baserCMS Version : 4.4.0 (Latest) Affected baserCMS Version : 4.0.0 ~ 4.4.0 Patches : https://basercms.net/security/20201029 Found by Aquilao Null

NVD description

baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.

References

baserproject/basercms security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-15277 · ADVISORY
baserproject/basercms commit bb027c3 · WEB
basercms.net/security/20201029 · WEB

More vulnerabilities in baserproject/basercms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

baserproject/basercms

Packagist

≥ 4.4.0, < 4.4.1

4.4.1

basercms

≥ 4.0.0, < 4.4.1

4.4.1

Description

baserCMS 4.4.0 and earlier is affected by Remote Code Execution (RCE).

NVD description

More vulnerabilities in baserproject/basercms

See all →