---
id: "CVE-2026-114623"
kind: "vulnerability"
aliases: ["CVE-2026-114623"]
title: "baserCMS: theme-file admin screen reads files outside theme directory"
severity: "medium"
cvss: 6.5
epss: 0.00567
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["basercms", "package", "php", "self-hosted"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-23T14:17:51+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114623", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114623", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# baserCMS: theme-file admin screen reads files outside theme directory

An authenticated user with theme-file view permission can use path traversal in the optional BcThemeFile plugin's admin screen to read .php, .css, .js and .ctp files outside the theme directory. This can expose application source and database credentials in config/install.php, and possibly the Security.salt fallback in config/app_local.php.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the baserCMS version in the project (for example `composer show basercms/basercms` or the `composer.json` lock file) and compare it with `5.3.2` and `5.4.2`.
- Check whether the BcThemeFile plugin is enabled in the baserCMS plugin admin screen or `config/plugins.php`.
- Check which admin roles hold theme-file view permission.

## Fix

- Upgrade baserCMS to `5.3.2` on the 5.3 line or `5.4.2` on the 5.4 line.
- If the upgrade cannot be done now, disable the BcThemeFile plugin.
- Rotate the database password in config/install.php and the Security.salt value if the admin screen was reachable by untrusted users.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114623
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114623

## From the sources

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containing literal ../ segments, and the view and edit actions pass it to ThemeFilesService::get() without containment validation. Authorization checks the unresolved request path, after which ThemeFile::_getContents() reads the resolved file and exposes its contents in the form textarea. A client must preserve the dot segments rather than normalize them away. Readable files are limited to .php, .css, .js, and .ctp; this can disclose application source and config/install.php database credentials in MySQL or PostgreSQL deployments, while SQLite configurations have an empty database password. Reading config/app_local.php may expose the Security.salt fallback, which is effective only when not overridden by environment configuration. The flaw does not disclose .env, .pem, or SQLite .db files, does not itself permit file writes or code execution, and does not affect the separate API getFullpath() route. The plugin is disabled by default and unauthenticated requests are not sufficient. This issue has been patched in versions 5.3.2 and 5.4.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_