CVE-2026-21861
published 2026-03-31CVE-2026-21861: baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality…
PriorityP355high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
2.28%
81.0th percentile
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| basercms | basercms | < 5.2.3 | 5.2.3 |
| baserproject | basercms | < 5.2.3 | 5.2.3 |
| baserproject | basercms | >= 0 < 5.2.3 | 5.2.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
osv·2026-03-31
CVE-2026-21861 [CRITICAL] baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
## Summary
In the core update functionality of baserCMS, some parameters sent from the admin panel are passed to the `exec()` function without proper validation or escaping. This issue allows **an authenticated CMS administrator to execute arbitrary OS commands on the server (Remote Code Execution, RCE)**.
This vulnerability is not a UI-level issue such as screen manipulation or lack of CSRF protection, but rather stems from **a design that directly executes input values received on the server side as OS commands**. Therefore, even if buttons are hidden in the UI, or even if CakePHP's CSRF/FormProtection (SecurityComponent) ensures that only legitimate POST requests are accepted, **an attack is possible as long as
GHSA
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
ghsa·2026-03-31
CVE-2026-21861 [CRITICAL] CWE-78 baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
## Summary
In the core update functionality of baserCMS, some parameters sent from the admin panel are passed to the `exec()` function without proper validation or escaping. This issue allows **an authenticated CMS administrator to execute arbitrary OS commands on the server (Remote Code Execution, RCE)**.
This vulnerability is not a UI-level issue such as screen manipulation or lack of CSRF protection, but rather stems from **a design that directly executes input values received on the server side as OS commands**. Therefore, even if buttons are hidden in the UI, or even if CakePHP's CSRF/FormProtection (SecurityComponent) ensures that only legitimate POST requests are accepted, **an attack is possible as long as
No detection rules found.
No public exploits indexed.
2026-03-31
Published