baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the “File” field is being used in the mail form.
[
{
"product": "baserCMS",
"vendor": "baserCMS Users Community",
"versions": [
{
"status": "affected",
"version": "3.0.14 and earlier"
},
{
"status": "affected",
"version": "4.0.5 and earlier"
}
]
}
]