Content management and web applications
baserCMS 5: admin SQL injection, path traversal and deserialization (CVE-2026-114621, CVE-2026-114622, CVE-2026-114624)
baserCMS check
baserCMS is a website development framework and CMS written in PHP. Its security releases 5.3.2 and 5.4.2, published on 23 October 2026, fix three flaws rated High.
| CVE | CVSS | What | Affected |
|---|---|---|---|
| CVE-2026-114621 | 8.8 (v3.1) | SQL injection in the admin panel and the admin API. The list and detail actions of the Admin and Api/Admin prefixes pass request query parameters (contain, conditions, fields, finder, order) straight to the ORM as options, so a logged-in user can inject SQL and read data such as password hashes |
5.0.0 before 5.3.2, and 5.4.0 before 5.4.2 |
| CVE-2026-114622 | 7.2 | Path traversal (CWE-22) | 5.2.3 before 5.3.2, and 5.4.0 before 5.4.2 |
| CVE-2026-114624 | 7.2 | Deserialization of untrusted data (CWE-502). An administrator, or an attacker who gets widget-write capability through another flaw such as chained XSS, can plant an object graph that fires on unauthenticated page requests. Two gadget chains in the default dependency set reach proc_open() and run commands as the web server user |
5.0.0 before 5.3.2, and 5.4.0 before 5.4.2 |
| Fixed | 5.3.2 and 5.4.2 |
| Fixed releases | 5.3.2 and 5.4.2. Sites on 5.0 to 5.2 move to one of them |
| Needs | A logged-in account for CVE-2026-114621; an administrator or widget-write access for CVE-2026-114624. None of the three is reachable by a visitor with no account, except that the planted object of CVE-2026-114624 fires on unauthenticated page requests |
| Exploitation | None reported in the sources used |
How the script reads a site
The version is the first line of plugins/baser-core/VERSION.txt (the file continues with a banner, which is ignored). Each flaw is judged on its own range. The script also reads the two things the fix for CVE-2026-114621 adds: the removeOrmStructureFromRequest() method in plugins/baser-core/src/Controller/AppController.php, and 'order' in the list of ORM structure keys that plugins/baser-core/src/Service/BcQueryParameterTrait.php strips. Both present means that fix is there, whatever the version string says. A fixed version whose files lack it is a failed update. One of the two is a partial update. These signatures cover CVE-2026-114621 only, so the other two flaws are always judged by version. A pre-release of a fixed release (5.3.2-rc1) is below it.
curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/basercms/basercms-check.sh
less basercms-check.sh
chmod +x basercms-check.sh
./basercms-check.sh check
By default it searches /var/www /srv /opt /home. Pass directories to narrow it. Everything is read-only.
| Command | What it does |
|---|---|
check (default) |
Finds baserCMS 5 sites by plugins/baser-core/VERSION.txt, judges the three flaws separately, and reports. Exit 0 nothing exposed, 1 exposed or unverifiable |
version |
Prints the script version |
There is no hunt
No indicators of exploitation have been published for these flaws, so the script has none. A clean check shows the version is fixed, not that the site was never attacked.
Update
Update to 5.3.2 or 5.4.2 or later. Until you can, the project suggests restricting the admin area and the admin API to trusted addresses and removing accounts you do not need. This is PrivacySafe's recommendation.
If a site was exposed
CVE-2026-114621 can read password hashes: rotate administrator passwords and review administrator accounts. CVE-2026-114624 plants an object graph through widgets: review the widget areas for entries you did not create.
Sources
Before you run it
- The fix. Update to 5.3.2 or 5.4.2. Sites on 5.0 to 5.2 move to 5.3.2 or 5.4.2.
- It reads the code as well as the version. The version comes from the first line of
plugins/baser-core/VERSION.txt, and for CVE-2026-114621 the script also looks for the two fix signatures in the source, so a backport under an older version number is recognized. - Not everything in the release is covered. baserCMS 5.3.1 lists unauthenticated SQL injections that are identified only by an advisory ID; they are not checked here.
- There is no hunt. No indicators of exploitation have been published for these flaws.
- It also checks running docker and podman containers, unless you name a directory or set
SCAN_CONTAINERS=0. The check finds installs inside running docker and podman containers by their marker file, copies only the files it reads into a private temporary directory, and judges them like a host install. A path shown as.../docker_NAME_PATHis the PATH inside the container NAME. It never runs anything in a container beyondfindand a file copy, never copies.envorwp-config.php, never keeps a staged symlink, and is skipped when you name directories yourself.
The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
