CVE-2026-114623 in BaserCMS
Summary
by MITRE • 10/23/2026
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containing literal ../ segments, and the view and edit actions pass it to ThemeFilesService::get() without containment validation. Authorization checks the unresolved request path, after which ThemeFile::_getContents() reads the resolved file and exposes its contents in the form textarea. A client must preserve the dot segments rather than normalize them away. Readable files are limited to .php, .css, .js, and .ctp; this can disclose application source and config/install.php database credentials in MySQL or PostgreSQL deployments, while SQLite configurations have an empty database password. Reading config/app_local.php may expose the Security.salt fallback, which is effective only when not overridden by environment configuration. The flaw does not disclose .env, .pem, or SQLite .db files, does not itself permit file writes or code execution, and does not affect the separate API getFullpath() route. The plugin is disabled by default and unauthenticated requests are not sufficient. This issue has been patched in versions 5.3.2 and 5.4.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in baserCMS affects version ranges 5.0.0 through 5.3.1 and 5.4.0 through 5.4.1, representing a critical path traversal flaw within the BcThemeFile plugin's administrative interface. This security defect allows an authenticated user possessing only theme-file view permissions to access files outside the designated theme directory by manipulating URL paths with literal dot-dot segments. The core technical failure lies in the ThemeFilesController::parseArgs() method, which constructs a file path containing these traversal sequences without performing adequate containment validation before passing it to ThemeFilesService::get(). Crucially, the authorization checks performed prior to this operation evaluate only the unresolved request path rather than the final resolved filesystem path. This discrepancy enables an attacker to bypass access controls by preserving dot segments in the HTTP request, thereby tricking the application into reading arbitrary files from the server's file system that would otherwise be inaccessible under normal operational constraints.
The exploitation of this vulnerability results in significant information disclosure, particularly regarding sensitive configuration data and source code. The flaw permits the reading of specific file types including .php, .css, .js, and .ctp extensions. In deployments utilizing MySQL or PostgreSQL databases, attackers can extract config/install.php files to obtain database credentials. For SQLite configurations, while the database password may be empty, other critical application secrets remain exposed. Notably, accessing config/app_local.php allows an attacker to retrieve the Security.salt value if it has not been overridden by environment variables; this salt is vital for cryptographic operations and its exposure compromises session security and data integrity mechanisms. The vulnerability specifically targets administrative functionality via the Admin web screen, requiring authentication but only minimal privileges related to theme file viewing, which lowers the barrier for exploitation compared to full administrator access requirements.
From a classification perspective, this issue aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-611: Improper Restriction of XML External Entity Reference if interpreted broadly as improper input validation leading to unauthorized resource access, though it is more accurately categorized under path traversal vulnerabilities. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1083: File and Directory Discovery, where an adversary uses valid credentials to enumerate and read sensitive files for further exploitation or intelligence gathering. The impact extends beyond simple data leakage as exposure of cryptographic salts can facilitate offline brute-force attacks against user passwords if session hashes are also compromised through other vectors. However, the scope is strictly limited; it does not permit file writes, code execution, or direct remote command injection, nor does it affect .env files, PEM certificates, SQLite database files, or the separate API getFullpath() route which handles full path resolution differently and remains unaffected by this specific logic error.
Mitigation strategies primarily involve upgrading to patched versions of baserCMS, specifically 5.3.2 and 5.4.2, where the validation logic has been corrected to ensure that resolved paths remain within allowed directories before file access is granted. For organizations unable to immediately patch, disabling the BcThemeFile plugin effectively neutralizes this risk as it is disabled by default in many configurations but may be enabled for theme development purposes. Additionally, implementing strict input validation on all user-supplied path segments and ensuring that authorization checks are performed against canonicalized paths rather than raw request URIs provides a defensive layering approach. Security monitoring should also focus on detecting unusual patterns of dot-dot segment usage in administrative interface requests to identify potential exploitation attempts before successful data exfiltration occurs.