CVE-2026-114622 in BaserCMS
Summary
by MITRE • 10/23/2026
baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because normalizePath() resolves only literal dot segments, percent-encoded traversal can pass the containment checks and become a path outside the theme directory at the write sink. An authenticated administrator can write PHP files into writable locations such as webroot and execute them, exceeding the intended theme-template editing boundary. The source also identifies the same check-before-decode ordering in ThemeFilesService::copy(), although that path was not dynamically verified. Exploitation requires the non-default plugin, an administrator session, and a same-origin Origin header; USE_CORE_ADMIN_API=false does not block session-authenticated requests. The Admin web form is not affected by this encoded-path tampering because FormProtection protects fullpath. This is a third bypass of the protections associated with CVE-2026-30940, using encoded traversal decoded after validation. This issue has been patched in versions 5.3.2 and 5.4.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in baserCMS versions prior to 5.3.2 and 5.4.2 represents a critical path traversal flaw within the optional BcThemeFile plugin, specifically affecting its Admin API functionality. This issue is categorized as CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which allows an attacker to access files outside the intended directory structure. The core technical failure lies in the inconsistent handling of URL-encoded characters during file path validation and subsequent processing. In the ThemeFilesService::update() and getFullpath() methods, the system performs containment checks on the raw input path to ensure it remains within the designated theme directory boundaries. However, the subsequent operation performed by ThemeFileForm::_execute() applies a urldecode function to this full path before writing the file to disk. This check-before-decode ordering creates a significant security gap where percent-encoded traversal sequences, such as %2e%2e for dot-dot-slash, bypass the initial validation because they appear literal and safe at that stage. Once decoded by the write sink, these sequences resolve into actual directory traversals, allowing the file to be written outside the restricted theme folder.
The operational impact of this vulnerability is severe, as it enables authenticated administrators to achieve remote code execution under specific conditions. By exploiting the path traversal flaw, an attacker can craft a request that writes PHP files into writable web directories such as the webroot directory. Since these locations are typically accessible via HTTP requests, the uploaded scripts can be executed by any user or automated scanner, leading to full compromise of the underlying server environment. This effectively breaks the intended boundary between theme-template editing and arbitrary file system access. The vulnerability is particularly insidious because it serves as a third bypass mechanism related to CVE-2026-30940, demonstrating how attackers can chain different encoding techniques or timing errors in validation logic to circumvent security controls that might otherwise appear robust against standard traversal attempts.
Exploitation of this flaw requires several specific prerequisites and conditions. The target system must have the non-default BcThemeFile plugin installed and enabled. Furthermore, the attacker must possess valid administrative credentials to access the Admin API endpoints involved in theme file management. Network-level constraints also play a role; successful exploitation typically requires an Origin header that matches the same origin as the application, which may limit automated remote exploitation but does not prevent attacks from malicious insiders or compromised admin sessions with controlled headers. Notably, configuration settings such as USE_CORE_ADMIN_API=false do not mitigate this risk for session-authenticated requests, indicating that authentication is the primary control point rather than API feature toggles. It is important to distinguish this vulnerability from issues affecting the Admin web form interface; those interfaces are protected by FormProtection mechanisms which validate and sanitize inputs more rigorously before processing, thereby preventing similar encoded-path tampering in that specific context.
To mitigate this risk, organizations running affected versions of baserCMS must immediately upgrade to version 5.3.2 or later for the 5.x branch, or version 5.4.2 and above for the newer release line where these issues have been patched. The fix involves correcting the validation logic to ensure that path normalization occurs before containment checks are applied, ensuring that percent-encoded traversal sequences are resolved into their literal forms prior to security evaluation. Additionally, developers should adopt a defense-in-depth strategy by implementing strict allowlists for permitted file extensions and directory paths rather than relying solely on negative pattern matching or simple string comparisons. Monitoring web server logs for unusual patterns of URL encoding in administrative API requests can also aid in detecting attempted exploitation activities while patching efforts are underway. This incident underscores the importance of consistent input handling across all stages of request processing, particularly when dealing with file system operations that carry high privilege implications.