CVE-2026-114622

The website development framework baserCMS contains an encoded path traversal bypass in the optional BcThemeFile plugin 's Admin API, affecting versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2. The root cause is an incorrect behavior order where ThemeFilesService::update() and getFullpath() val...