CVE-2026-115481

🗓️ 23 Oct 2026 13:34:26Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 21 Views🌐 WEB

Arbitrary PHP file upload in baserCMS BcCustomContent via wildcard allow rules.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2026-115481	23 Oct 202615:04	–	circl
CNNVD	baserproject baserCMS arbitrary file upload vulnerability	23 Oct 202600:00	–	cnnvd
Cvelist	CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload	23 Oct 202613:34	–	cvelist
EUVD	EUVD-2026-108983	23 Oct 202613:34	–	euvd
Mend	CVE-2026-115481	23 Oct 202613:34	–	mend
NVD	CVE-2026-115481	23 Oct 202614:17	–	nvd
Positive Technologies	PT-2026-122106	23 Oct 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload	23 Oct 202613:34	–	vulnrichment

Vulners

Node

basercms basercmsRange5.0.0-beta1–5.3.2

basercms basercmsRange5.4.0–5.4.2

[
  {
    "vendor": "baserproject",
    "product": "basercms",
    "versions": [
      {
        "version": ">= 5.0.0-beta1, < 5.3.2",
        "status": "affected"
      },
      {
        "version": ">= 5.4.0, < 5.4.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/baserproject/basercms/releases/tag/5.4.2
github	www.github.com/baserproject/basercms/commit/2ed19c878add5c26fc765572e0e77173c1f1fdb5
github	www.github.com/baserproject/basercms/releases/tag/5.3.2
github	www.github.com/baserproject/basercms/commit/b0ef31b10dc6267b48ebc9a80d34bc7c4c09c311
github	www.github.com/baserproject/basercms/security/advisories/GHSA-8jrp-4h7c-m679

Parameter	Position	Path	Description	CWE
<prefix>	path	/baser/<prefix>/<plugin>/*	The application writes a wildcard allow rule for non-admin groups when a plugin's permission file is missing, allowing the 'operators' group to execute arbitrary PHP under the document root.	CWE-434
<plugin>	path	/baser/<prefix>/<plugin>/*	The application writes a wildcard allow rule for non-admin groups when a plugin's permission file is missing, allowing the 'operators' group to execute arbitrary PHP under the document root.	CWE-434

23 Oct 2026 16:28Current

6.1Medium risk

Vulners AI Score6.1

CVSS 48.5

EPSS0.00401

SSVC

CWE-434