CVE-2026-30877: baserCMS: OS Command Injection in the baserCMS Update Functionality
Summary The latest version of baserCMS (basercms-5.2.2) contains an OS command injection vulnerability (CWE-78) in its update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS.
Details Please refer to the attached materials. OSコマンドインジェクション（baserCMSのアップデート機能）.pdf
Impact An authenticated user with administrator privileges in baserCMS can execute OS commands on the server with the privileges of the user account running baserCMS.
Other sources
baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30877?
The CVE-2026-30877 vulnerability has a high severity rating due to OS command injection risks.
How does CVE-2026-30877 affect baserCMS?
CVE-2026-30877 allows an authenticated user with administrator privileges to execute arbitrary commands on the server.
How do I fix CVE-2026-30877?
To fix CVE-2026-30877, upgrade baserCMS to version 5.2.3 or later.
What versions of baserCMS are affected by CVE-2026-30877?
CVE-2026-30877 affects all baserCMS versions prior to 5.2.3.
Who is at risk from CVE-2026-30877?
Authenticated users with administrator privileges on baserCMS are at risk from CVE-2026-30877.