{"id":"CVE-2026-114623","kind":"vulnerability","aliases":["CVE-2026-114623"],"related":[],"title":"baserCMS: theme-file admin screen reads files outside theme directory","description":"baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containing literal ../ segments, and the view and edit actions pass it to ThemeFilesService::get() without containment validation. Authorization checks the unresolved request path, after which ThemeFile::_getContents() reads the resolved file and exposes its contents in the form textarea. A client must preserve the dot segments rather than normalize them away. Readable files are limited to .php, .css, .js, and .ctp; this can disclose application source and config/install.php database credentials in MySQL or PostgreSQL deployments, while SQLite configurations have an empty database password. Reading config/app_local.php may expose the Security.salt fallback, which is effective only when not overridden by environment configuration. The flaw does not disclose .env, .pem, or SQLite .db files, does not itself permit file writes or code execution, and does not affect the separate API getFullpath() route. The plugin is disabled by default and unauthenticated requests are not sufficient. This issue has been patched in versions 5.3.2 and 5.4.2.","summary":"An authenticated user with theme-file view permission can use path traversal in the optional BcThemeFile plugin's admin screen to read .php, .css, .js and .ctp files outside the theme directory. This can expose application source and database credentials in config/install.php, and possibly the Security.salt fallback in config/app_local.php.","severity":"medium","cvss":6.5,"epss":0.00567,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["basercms","package","php","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the baserCMS version in the project (for example `composer show basercms/basercms` or the `composer.json` lock file) and compare it with `5.3.2` and `5.4.2`.\n- Check whether the BcThemeFile plugin is enabled in the baserCMS plugin admin screen or `config/plugins.php`.\n- Check which admin roles hold theme-file view permission.","fix":"- Upgrade baserCMS to `5.3.2` on the 5.3 line or `5.4.2` on the 5.4 line.\n- If the upgrade cannot be done now, disable the BcThemeFile plugin.\n- Rotate the database password in config/install.php and the Security.salt value if the admin screen was reachable by untrusted users.","status":"open","published_at":"2026-10-23T14:17:51+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:47:17+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:47:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade baserCMS to `5.3.2` on the 5.3 line or `5.4.2` on the 5.4 line.\n- If the upgrade cannot be done now, disable the BcThemeFile plugin.\n- Rotate the database password in config/install.php and the Security.salt value if the admin screen was reachable by untrusted users.","reach":"internet","title":"baserCMS: theme-file admin screen reads files outside theme directory","impact":"medium","summary":"An authenticated user with theme-file view permission can use path traversal in the optional BcThemeFile plugin's admin screen to read .php, .css, .js and .ctp files outside the theme directory. This can expose application source and database credentials in config/install.php, and possibly the Security.salt fallback in config/app_local.php.","category":"package","nicknames":[],"who_cares":["basercms","php","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated user reads application source and database credentials","analyst_note":"","how_to_check":"- Check the baserCMS version in the project (for example `composer show basercms/basercms` or the `composer.json` lock file) and compare it with `5.3.2` and `5.4.2`.\n- Check whether the BcThemeFile plugin is enabled in the baserCMS plugin admin screen or `config/plugins.php`.\n- Check which admin roles hold theme-file view permission.","needs_analyst":false,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Sites running baserCMS 5.0.0 to before 5.3.2 or 5.4.0 to before 5.4.2 with the optional BcThemeFile plugin enabled. Exposure needs an authenticated admin account that holds theme-file view permission, so sites with the plugin disabled, which is the default, or with no such accounts can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":3632,"output_tokens":678,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114623':14A,17A '-2026':13A,16A '5.0.0':82C '5.3.2':84C,267C '5.4.0':86C '5.4.2':88C,269C 'action':127C 'admin':5A,43B,111C 'affect':242C 'api':245C 'applic':60B,183C 'authent':25B,90C 'author':136C 'away':169C 'basercm':1A,18B,74C 'bcthemefil':40B,108C 'check':137C 'client':159C 'code':237C 'config/app_local.php':73B,203C 'config/install.php':66B,186C 'configur':196C,218C 'construct':116C 'contain':119C,134C 'content':153C 'credenti':64B,188C 'css':48B,176C 'ctp':51B,179C 'cve':12A,15A 'databas':63B,187C,200C 'db':228C 'default':253C 'deploy':193C 'develop':78C 'directori':11A,56B,104C 'disabl':251C 'disclos':182C,223C 'dot':163C 'edit':126C 'effect':211C 'empti':199C 'env':224C 'environ':217C 'execut':238C 'expos':59B,151C,205C 'fallback':71B,208C 'file':4A,8A,30B,52B,96C,149C,171C,229C,234C 'flaw':220C 'form':156C 'framework':79C 'get':132C 'getcont':145C 'getfullpath':246C 'host':23B 'issu':261C 'js':49B,177C 'limit':173C 'liter':120C 'may':204C 'must':160C 'mysql':190C 'normal':167C 'option':39B,107C 'outsid':9A,53B,101C 'overridden':215C 'packag':19B 'parsearg':115C 'pass':128C 'password':201C 'patch':264C 'path':35B,118C,141C 'pem':225C 'permiss':32B,98C 'permit':233C 'php':20B,47B,175C 'plugin':41B,109C,249C 'possibl':68B 'postgresql':192C 'preserv':161C 'rather':165C 'read':7A,46B,146C,202C 'readabl':170C 'request':140C,256C 'resolv':148C 'rout':247C 'screen':6A,44B,113C 'security.salt':70B,207C 'segment':121C,164C 'self':22B 'self-host':21B 'separ':244C 'sourc':61B,184C 'sqlite':195C,227C 'suffici':259C 'textarea':157C 'theme':3A,10A,29B,55B,95C,103C 'theme-fil':2A,28B,94C 'themefil':144C 'themefilescontrol':114C 'themefilesservic':131C 'travers':36B,100C 'unauthent':255C 'unresolv':139C 'use':34B 'user':26B,91C 'valid':135C 'version':81C,266C 'view':31B,97C,124C 'web':112C 'websit':77C 'without':133C 'write':235C","nicknames":[],"mitigations":[],"who_affected":"Sites running baserCMS 5.0.0 to before 5.3.2 or 5.4.0 to before 5.4.2 with the optional BcThemeFile plugin enabled. Exposure needs an authenticated admin account that holds theme-file view permission, so sites with the plugin disabled, which is the default, or with no such accounts can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114623","severity":null,"published_at":"2026-10-23T14:17:51+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114623","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114623","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}