baserproject BaserCMS up to 5.3.1/5.4.1 Widget-Area Entity unserialize deserialization

Summaryinfo

A vulnerability identified as problematic has been detected in baserproject BaserCMS up to 5.3.1/5.4.1. This vulnerability affects the function unserialize of the component Widget-Area Entity. The manipulation leads to deserialization. This vulnerability is referenced as CVE-2026-114624. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in baserproject BaserCMS up to 5.3.1/5.4.1. This issue affects the function unserialize of the component Widget-Area Entity. The manipulation with an unknown input leads to a deserialization vulnerability. Using CWE to declare the problem leads to CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests. Two demonstrated gadget chains in the default dependency set use composer/composer ProcessExecutor::startJob() with Process::fromShellCommandline(), or logiscape/mcp-sdk-php StdioTransport::connect() with StdioServerParameters, to reach proc_open() and execute commands as the web-server user. Deserialization bypasses constructor-based readonly safeguards, and the stored payload can execute repeatedly until the database row is repaired. Unauthenticated page access is a trigger after privileged payload storage, not an unauthenticated means of initially planting the payload. This issue has been patched in versions 5.3.2 and 5.4.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-114624 since 10/21/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. Technical details are known, but no exploit is available.

Upgrading to version 5.3.2 or 5.4.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-108995). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• baserproject

Name

• BaserCMS

Version

• 5.3.0
• 5.3.1
• 5.4.0
• 5.4.1

License

• open-source

Website

• Product: https://github.com/baserproject/basercms/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion