Live › vulnerability › CVE-2026-114623
Go to dashboardAn authenticated user with theme-file view permission can use path traversal in the optional BcThemeFile plugin's admin screen to read .php, .css, .js and .ctp files outside the theme directory. This can expose application source and database credentials in config/install.php, and possibly the Security.salt fallback in config/app_local.php.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running baserCMS 5.0.0 to before 5.3.2 or 5.4.0 to before 5.4.2 with the optional BcThemeFile plugin enabled. Exposure needs an authenticated admin account that holds theme-file view permission, so sites with the plugin disabled, which is the default, or with no such accounts can skip it.
No product ranges from the sources yet.
composer show basercms/basercms or the composer.json lock file) and compare it with 5.3.2 and 5.4.2.config/plugins.php.5.3.2 on the 5.3 line or 5.4.2 on the 5.4 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containing literal ../ segments, and the view and edit actions pass it to ThemeFilesService::get() without containment validation. Authorization checks the unresolved request path, after which ThemeFile::_getContents() reads the resolved file and exposes its contents in the form textarea. A client must preserve the dot segments rather than normalize them away. Readable files are limited to .php, .css, .js, and .ctp; this can disclose application source and config/install.php database credentials in MySQL or PostgreSQL deployments, while SQLite configurations have an empty database password. Reading config/app_local.php may expose the Security.salt fallback, which is effective only when not overridden by environment configuration. The flaw does not disclose .env, .pem, or SQLite .db files, does not itself permit file writes or code execution, and does not affect the separate API getFullpath() route. The plugin is disabled by default and unauthenticated requests are not sufficient. This issue has been patched in versions 5.3.2 and 5.4.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-114623")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.