CVE-2026-115479: baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients
baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties. MailMessageMailer::sendFormToUser() passes the visitor-controlled userMail value to parseAndNormalizeMailAddresses(), which splits it with explode(',') and supplies every resulting address to setTo(). Newly created forms with an email-type field are affected when the separate, optional VALIDEMAIL server-side validation is not enabled; browser type=email validation does not prevent crafted requests. The bundled contact form enables VALIDEMAIL and is not affected. The auto-reply uses the site's sender identity and includes partially attacker-controlled content, allowing abuse of the site to deliver unsolicited mail. This issue has been patched in versions 5.3.2 and 5.4.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
baserCMSto a version that resolves this vulnerability.Fixed in 5.3.2 - Upgrade
Upgrade
baserCMSto a version that resolves this vulnerability.Fixed in 5.4.2 - Configuration
Enable the separate, optional VALID_EMAIL server-side validation for email-type fields in newly created forms.
baserCMS mail forms VALID_EMAIL = enabled
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running versions 5.2.5 before 5.3.2 or 5.4.0 before 5.4.2 are exposed only where a public mail form has an email-type field and does not enable the optional VALID_EMAIL server-side validation. The bundled contact form enables VALID_EMAIL and is not affected.
Does an attacker need an account or user interaction?
No. An unauthenticated visitor can submit a crafted request directly to an affected public mail form; browser type=email validation does not stop crafted requests.
What can an attacker do?
They can provide a comma-separated list of email addresses in the form's email field, causing one auto-reply to be sent to multiple third-party recipients. The messages use the site's sender identity and include partially attacker-controlled content.
What should be done if updating is not immediately possible?
Enable VALID_EMAIL server-side validation on every public mail form with an email-type field. This prevents the affected behavior described for forms that lack that optional validation.
How can we determine whether our forms are affected?
Review public mail forms for email-type fields and verify that VALID_EMAIL server-side validation is enabled. Forms with that validation enabled, including the bundled contact form, are not affected.