CVE-2026-114623

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs...

CVE-2026-114623

The baserCMS website development framework (versions 5.0.0 to 5.3.1 and 5.4.0 to 5.4.1 ) contains a path traversal vulnerability in the optional BcThemeFile plugin's Admin web screen. The flaw exists because ThemeFilesController::parseArgs() constructs paths with literal ../ segments, which are t...

CVE-2026-114623 baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs...

CVE-2026-114623 baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs...

EUVD-2026-108994

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs...

PT-2026-122102

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs...