psf-basercms-check(8)

Script: /opt/psf-security-patches/basercms/basercms-check.sh. Tool page: baserCMS. Source. With the package installed: man psf-basercms-check.

baserCMS 5 admin SQL injection, path traversal and deserialization: read-only checker  (v1)
CVE-2026-114621, CVE-2026-114622, CVE-2026-114624

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

baserCMS is a website development framework and CMS (PHP, CakePHP based). Its security
releases 5.3.2 and 5.4.2 of 23 October 2026 fix three flaws rated High:

  CVE-2026-114621  8.8 (v3.1)  SQL injection in the admin panel and the admin API. The list
                             and detail actions of the Admin and Api/Admin prefixes pass
                             request query parameters (contain, conditions, fields, finder,
                             order) straight to the ORM as options, so a logged-in user can
                             inject SQL and read data such as password hashes.
                             Affected: 5.0.0 before 5.3.2, and 5.4.0 before 5.4.2.
  CVE-2026-114622  7.2         Path traversal (CWE-22).
                             Affected: 5.2.3 before 5.3.2, and 5.4.0 before 5.4.2.
  CVE-2026-114624  7.2         Deserialization of untrusted data (CWE-502). An administrator,
                             or an attacker who gets widget-write capability through another
                             flaw such as chained XSS, can plant an object graph that fires on
                             unauthenticated page requests. Two gadget chains in the default
                             dependency set reach proc_open() and run commands as the web
                             server user. Affected: 5.0.0 before 5.3.2, and 5.4.0 before 5.4.2.

  Fixed: 5.3.2 and 5.4.2. Sites on 5.0 to 5.2 move to 5.3.2 or 5.4.2.

How this script reads a site. The version is the first line of
plugins/baser-core/VERSION.txt. Each flaw is judged on its own range. The script also reads
the two things the fix for CVE-2026-114621 adds: the removeOrmStructureFromRequest() method in
plugins/baser-core/src/Controller/AppController.php, and 'order' in the list of ORM
structure keys that plugins/baser-core/src/Service/BcQueryParameterTrait.php strips. Both
present means that fix is there, whatever the version string says; a fixed version whose
files lack it is a failed update; one of the two is a partial update. Those signatures
cover CVE-2026-114621 only, so the other two flaws are always judged by version.

No indicators of exploitation have been published for these flaws, so there is no hunt. This
script is read-only. A plain version file means a clean result cannot prove the site was not
attacked: after exposure, review administrator accounts and widgets, and rotate passwords.

Usage:
  ./basercms-check.sh [command] [DIR ...]

  check (default)  scan DIR (default /var/www /srv /opt /home) for baserCMS 5 sites. Exit 0 =
                   nothing exposed, 1 = an exposed or unverifiable site.
  version          print the script version.
Containers: with no directory argument the check also copies the files it reads from running
docker and podman containers (SCAN_CONTAINERS=1, the default; 0 skips them) and judges them like
host installs. The copies are temporary: a path shown as .../docker_NAME_PATH is the PATH inside
the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.