baserCMS has an SQL injection vulnerability in its blog post functionality

CRITICAL 9.8CVE-2026-27697 · GHSA-vh89-rjph-2g7p · Published 31/03/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
baserproject/basercms Packagist	`< 5.2.3`	`5.2.3`
basercms basercms	`< 5.2.3`	`5.2.3`

Description

baserCMS has a SQL injection vulnerability in blog posts.

Target

baserCMS 5.2.2 and earlier versions

Vulnerability

Malicious SQL may be executed in blog posts.

Countermeasures

Update to the latest version of baserCMS

Please refer to the following page to reference for more information. https://basercms.net/security/JVN_52157568

Credits

Mirai Matsumoto@Future Secure Wave, Inc.

NVD description

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.

References

baserproject/basercms security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-27697 · ADVISORY
basercms.net/security/JVN_20837860 · WEB
baserproject/basercms · PACKAGE
baserproject/basercms release 5.2.3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free