baserCMS has a cross-site scripting vulnerability in blog posts

MEDIUM 6.1CVE-2026-30879 · GHSA-jmq3-x8q7-j9qm · Published 31/03/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
baserproject/basercms Packagist	`< 5.2.3`	`5.2.3`
basercms basercms	`< 5.2.3`	`5.2.3`

Description

baserCMS has a cross-site scripting vulnerability in blog posts.

Target

baserCMS 5.2.1 and earlier versions

Vulnerability

Malicious Javascript may be executed in blog posts.

Countermeasures

Update to the latest version of baserCMS

Please refer to the following page to reference for more information. https://basercms.net/security/JVN_20837860

Credits

Gai Tanaka@Mitsui Bussan Secure Directions, Inc.

NVD description

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a cross-site scripting vulnerability in blog posts. This issue has been patched in version 5.2.3.

References

baserproject/basercms security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-30879 · ADVISORY
basercms.net/security/JVN_20837860 · WEB
baserproject/basercms · PACKAGE
baserproject/basercms release 5.2.3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free