CVE-2026-30880

baserCMS: OS command injection vulnerability in installer

State: Published
Severity: 9.2 Critical
Published: Mar 31, 2026
Updated: Mar 31, 2026
Reserved: Mar 6, 2026

Description

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
basercmsbaserproject	< 5.2.3Affected

References

https://github.com/baserproject/basercms/security/advisories/GHSA-6hpg-8rx3-cwgv
https://basercms.net/security/JVN_20837860
https://github.com/baserproject/basercms/releases/tag/5.2.3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.