CVE-2025-32957 in baserproject basercms

要約 (英語)

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.

責任者

GitHub_M

予約する

2025年04月14日

公開

2026年03月31日

エントリ

VulDB provides additional information and datapoints for this CVE:

識別子	脆弱性	CWE	悪用可	対策	CVE
354303	baserproject basercms require_once 特権昇格	434	未定義	公式な修正	CVE-2025-32957