baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

• CVE-2026-21861: 2.32% estimated exploitation activity in the next 30 days; percentile 83.49 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary In the core update functionality of baserCMS, some parameters sent from the admin panel are passed to the exec() function without proper validation or escaping. This issue allows an authenticated CMS administrator to execute arbitrary OS commands on the server (Remote Code Execution, RCE). This vulnerability is not a UI-level issue such as screen manipulation or lack of CSRF protection, but rather stems from a design that directly executes input values received on the server side as OS commands. Therefore, even if buttons are hidden in the UI, or even if CakePHP's CSRF/FormProtection (SecurityComponent) ensures that only legitimate POST requests are accepted, an attack is possible as long as a request containing a valid token is processed within an administrator session. --- Vulnerability Information | Item | Details | | ---- | ------- | | CWE | CWE-78: Improper Neutralization of Special Elements used in an OS Command | | Impact | Remote Code Execution (RCE) | | Severity |…

Published by the source

31 Mar 2026, 22:27 UTC

Last modified by the source

31 Mar 2026, 22:27 UTC

Source last checked

26 Oct 2026, 14:39 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-qxmc-6f24-g86g

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-21861

Advisory: baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
IDs: CVE-2026-21861, GHSA-qxmc-6f24-g86g
Record: https://patchnext.com/advisories/cve-2026-21861 (revision 1, source checked 26 Oct 2026, 14:39 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: baserproject/basercms 5.2.3. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist baserproject/basercms: affected <= 5.2.2; fixed in 5.2.3

## Suggested inspection (read-only)
- Packagist baserproject/basercms: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on baserproject/basercms.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-qxmc-6f24-g86g (GitHub-reviewed advisory GHSA-qxmc-6f24-g86g lists affected ranges: Packagist baserproject/basercms >=0 <=5.2.2)

Commands are suggestions: review each one before running it.