{"id":"CVE-2026-114622","kind":"vulnerability","aliases":["CVE-2026-114622"],"related":[],"title":"baserCMS: encoded path traversal lets an admin write and run PHP files","description":"baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because normalizePath() resolves only literal dot segments, percent-encoded traversal can pass the containment checks and become a path outside the theme directory at the write sink. An authenticated administrator can write PHP files into writable locations such as webroot and execute them, exceeding the intended theme-template editing boundary. The source also identifies the same check-before-decode ordering in ThemeFilesService::copy(), although that path was not dynamically verified. Exploitation requires the non-default plugin, an administrator session, and a same-origin Origin header; USE_CORE_ADMIN_API=false does not block session-authenticated requests. The Admin web form is not affected by this encoded-path tampering because FormProtection protects fullpath. This is a third bypass of the protections associated with CVE-2026-30940, using encoded traversal decoded after validation. This issue has been patched in versions 5.3.2 and 5.4.2.","summary":"In baserCMS, the optional BcThemeFile plugin decodes theme file paths after its path checks, so percent-encoded traversal can write files outside the theme directory. An authenticated administrator can plant PHP files in writable locations such as the webroot and execute them on the server.","severity":"high","cvss":7.2,"epss":0.00663,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["basercms","cms","package","php","self-hosted"],"not_affected_if":["default-config","patched-version","plugin-not-installed"],"how_to_check":"- Check the baserCMS version in the project, for example `composer show basercms/basercms` or the admin footer; affected are `5.2.3` to before `5.3.2` and `5.4.0` to before `5.4.2`.\n- Check whether the BcThemeFile plugin is installed and enabled, for example `ls plugins/` for BcThemeFile and its entry in the plugin list in the admin.","fix":"- Upgrade baserCMS to `5.3.2` on the 5.3 line or `5.4.2` on the 5.4 line.\n- Until patched, disable the BcThemeFile plugin if it is not needed.","status":"open","published_at":"2026-10-23T14:17:51+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:27:41+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:27:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade baserCMS to `5.3.2` on the 5.3 line or `5.4.2` on the 5.4 line.\n- Until patched, disable the BcThemeFile plugin if it is not needed.","reach":"network","title":"baserCMS: encoded path traversal lets an admin write and run PHP files","impact":"high","summary":"In baserCMS, the optional BcThemeFile plugin decodes theme file paths after its path checks, so percent-encoded traversal can write files outside the theme directory. An authenticated administrator can plant PHP files in writable locations such as the webroot and execute them on the server.","category":"package","nicknames":[],"who_cares":["basercms","php","self-hosted","cms"],"confidence":0.8,"needs_auth":"yes","worst_case":"Administrator plants PHP files in webroot and runs code on the server","analyst_note":"","how_to_check":"- Check the baserCMS version in the project, for example `composer show basercms/basercms` or the admin footer; affected are `5.2.3` to before `5.3.2` and `5.4.0` to before `5.4.2`.\n- Check whether the BcThemeFile plugin is installed and enabled, for example `ls plugins/` for BcThemeFile and its entry in the plugin list in the admin.","needs_analyst":false,"not_affected_if":["default-config","patched-version","plugin-not-installed"],"who_is_affected":"Sites running baserCMS 5.2.3 to before 5.3.2 or 5.4.0 to before 5.4.2 with the optional BcThemeFile plugin enabled. The exposure needs an administrator account, so sites where only trusted staff hold admin access carry lower risk, but the plugin's permission boundary is still bypassed. Sites without the plugin, or running patched versions, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":3614,"output_tokens":660,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114622':15A,18A '-2026':14A,17A,243C '-30940':244C '5.2.3':80C '5.3.2':82C,258C '5.4.0':84C '5.4.2':86C,260C 'admin':7A,92C,205C,216C 'administr':54B,143C,194C 'affect':221C 'also':167C 'although':179C 'api':93C,206C 'appli':107C 'associ':240C 'authent':53B,142C,213C 'basercm':1A,19B,27B,72C 'bcthemefil':30B,89C 'becom':130C 'block':210C 'boundari':164C 'bypass':236C 'check':39B,128C,172C 'check-before-decod':171C 'cms':20B 'contain':127C 'copi':178C 'core':204C 'cve':13A,16A,242C 'decod':32B,174C,248C 'default':191C 'develop':76C 'directori':51B,136C 'dot':118C 'dynam':184C 'edit':163C 'encod':2A,43B,122C,225C,246C 'encoded-path':224C 'exceed':157C 'execut':67B,105C,155C 'exploit':186C 'fals':207C 'file':12A,34B,47B,58B,147C 'form':218C 'formprotect':229C 'framework':77C 'fullpath':110C,231C 'getfullpath':102C 'header':202C 'host':25B 'identifi':168C 'intend':159C 'issu':252C 'let':5A 'liter':117C 'locat':61B,150C 'non':190C 'non-default':189C 'normalizepath':114C 'option':29B,88C 'order':175C 'origin':200C,201C 'outsid':48B,133C 'packag':21B 'pass':125C 'patch':255C 'path':3A,35B,38B,97C,132C,181C,226C 'percent':42B,121C 'percent-encod':41B,120C 'php':11A,22B,57B,146C 'plant':56B 'plugin':31B,90C,192C 'protect':230C,239C 'raw':96C 'rawurldecod':108C 'request':214C 'requir':187C 'resolv':115C 'run':10A 'same-origin':198C 'segment':119C 'self':24B 'self-host':23B 'server':71B 'session':195C,212C 'session-authent':211C 'sink':140C 'sourc':166C 'subsequ':106C 'tamper':227C 'templat':162C 'theme':33B,50B,135C,161C 'theme-templ':160C 'themefileform':104C 'themefilesservic':99C,177C 'third':235C 'travers':4A,44B,123C,247C 'updat':100C 'use':203C,245C 'valid':94C,250C 'verifi':185C 'version':79C,257C 'web':217C 'webroot':65B,153C 'websit':75C 'writabl':60B,149C 'write':8A,46B,112C,139C,145C","nicknames":[],"mitigations":[],"who_affected":"Sites running baserCMS 5.2.3 to before 5.3.2 or 5.4.0 to before 5.4.2 with the optional BcThemeFile plugin enabled. The exposure needs an administrator account, so sites where only trusted staff hold admin access carry lower risk, but the plugin's permission boundary is still bypassed. Sites without the plugin, or running patched versions, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114622","severity":null,"published_at":"2026-10-23T14:17:51+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114622","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114622","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}