baserCMS has OS command injection vulnerability in installer

CRITICAL 9.8CVE-2026-30880 · GHSA-6hpg-8rx3-cwgv · Published 31/03/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
baserproject/basercms Packagist	`< 5.2.3`	`5.2.3`
basercms basercms	`< 5.2.3`	`5.2.3`

Description

baserCMS has an OS command injection vulnerability in the installer.

Target

baserCMS 5.2.2 and earlier versions

Vulnerability

If baserCMS is placed on a server but not installed, malicious commands may be executed.

Countermeasures

Update to the latest version of baserCMS

Please refer to the following page to reference for more information. https://basercms.net/security/JVN_54513170

Credits

REN XINGDIAN

NVD description

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.

References

baserproject/basercms security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-30880 · ADVISORY
basercms.net/security/JVN_20837860 · WEB
baserproject/basercms · PACKAGE
baserproject/basercms release 5.2.3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free