{"id":"CVE-2026-114624","kind":"vulnerability","aliases":["CVE-2026-114624"],"related":[],"title":"baserCMS: stored widget data deserialized, enabling command execution on page load","description":"baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests. Two demonstrated gadget chains in the default dependency set use composer/composer ProcessExecutor::startJob() with Process::fromShellCommandline(), or logiscape/mcp-sdk-php StdioTransport::connect() with StdioServerParameters, to reach proc_open() and execute commands as the web-server user. Deserialization bypasses constructor-based readonly safeguards, and the stored payload can execute repeatedly until the database row is repaired. Unauthenticated page access is a trigger after privileged payload storage, not an unauthenticated means of initially planting the payload. This issue has been patched in versions 5.3.2 and 5.4.2.","summary":"baserCMS stores widget-area values that are later read back with unserialize() and no class restrictions. A stored serialized payload can reach proc_open() through composer or MCP SDK gadget chains and run commands as the web-server user each time the page renders.","severity":"high","cvss":7.2,"epss":0.00922,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["basercms","cms","php","runtime","self-hosted"],"not_affected_if":["no-widget-write-access","patched-5.3.2-or-5.4.2"],"how_to_check":"- Check the baserCMS version: affected versions are `5.0.0` to before `5.3.2` and `5.4.0` to before `5.4.2`.\n- Look for `composer/composer` and `logiscape/mcp-sdk-php` in `composer.lock`, since the demonstrated gadget chains use them.\n- Inspect the widget-area database rows for serialized or base64-encoded PHP data.","fix":"- Upgrade baserCMS to `5.3.2` on the 5.3 line or `5.4.2` on the 5.4 line.\n- After upgrading, repair any widget-area database rows that hold serialized data, because the description says a stored payload keeps executing until its row is repaired.\n- Review admin accounts and widget-write permissions.","status":"open","published_at":"2026-10-23T14:17:51+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:27:45+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-25T03:27:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade baserCMS to `5.3.2` on the 5.3 line or `5.4.2` on the 5.4 line.\n- After upgrading, repair any widget-area database rows that hold serialized data, because the description says a stored payload keeps executing until its row is repaired.\n- Review admin accounts and widget-write permissions.","reach":"internet","title":"baserCMS: stored widget data deserialized, enabling command execution on page load","impact":"high","summary":"baserCMS stores widget-area values that are later read back with unserialize() and no class restrictions. A stored serialized payload can reach proc_open() through composer or MCP SDK gadget chains and run commands as the web-server user each time the page renders.","category":"runtime","nicknames":[],"who_cares":["basercms","php","self-hosted","cms"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs commands as the web-server user on page load","analyst_note":"","how_to_check":"- Check the baserCMS version: affected versions are `5.0.0` to before `5.3.2` and `5.4.0` to before `5.4.2`.\n- Look for `composer/composer` and `logiscape/mcp-sdk-php` in `composer.lock`, since the demonstrated gadget chains use them.\n- Inspect the widget-area database rows for serialized or base64-encoded PHP data.","needs_analyst":false,"not_affected_if":["patched-5.3.2-or-5.4.2","no-widget-write-access"],"who_is_affected":"Sites running baserCMS 5.0.0 through 5.3.x before 5.3.2, or 5.4.0 through 5.4.x before 5.4.2, are exposed. Exploitation requires an administrator or an attacker with widget-write access, such as one obtained through chained XSS, to store the payload first, but the trigger is then ordinary unauthenticated page requests. Sites already on `5.3.2` or `5.4.2` or later can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.001216,"input_tokens":3628,"output_tokens":1706,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114624':14A,17A '-2026':13A,16A '5.0.0':79C '5.3.2':81C,256C '5.4.0':83C '5.4.2':85C,258C 'accept':135C 'access':232C 'admin':107C 'administr':145C 'allow':101C,132C 'api':109C,122C 'area':29B,89C 'array':100C 'attack':148C 'back':35B 'base':214C 'base64':140C 'base64-encoded':139C 'basercm':1A,18B,25B,71C 'bypass':211C 'capabl':154C 'chain':56B,161C,178C 'class':40B,133C 'cms':19B 'command':7A,59B,203C 'compos':51B 'composer/composer':185C 'connect':194C 'constructor':213C 'constructor-bas':212C 'cve':12A,15A 'data':4A,143C 'databas':226C 'default':181C 'demonstr':176C 'depend':182C 'deseri':5A,124C,210C 'develop':75C 'enabl':6A 'encod':141C 'end':119C 'entiti':90C,114C 'execut':8A,202C,222C 'framework':76C 'fromshellcommandlin':190C 'front':118C 'front-end':117C 'gadget':55B,177C 'graph':167C 'host':24B 'includ':116C 'initi':245C 'issu':250C 'json':108C 'later':33B 'load':11A 'logiscape/mcp-sdk-php':192C 'mcp':53B 'mean':243C 'object':166C 'obtain':150C 'open':49B,200C 'page':10A,69B,173C,231C 'patch':253C 'payload':45B,220C,238C,248C 'php':20B 'plant':164C,246C 'privileg':237C 'proc':48B,199C 'process':189C 'processexecutor':186C 'raw':137C 'reach':47B,198C 'read':34B,115C 'readon':215C 'render':70B,120C 'repair':229C 'repeat':223C 'request':174C 'respons':123C 'restrict':41B,134C 'row':227C 'run':58B 'runtim':21B 'safeguard':216C 'sdk':54B 'self':23B 'self-host':22B 'separ':157C 'serial':44B,91C,142C 'server':64B,208C 'set':183C 'startjob':187C 'stdioserverparamet':196C 'stdiotransport':193C 'storag':239C 'store':2A,26B,43B,112C,126C,219C 'string':103C 'submit':96C,104C 'subsequ':169C 'time':67B 'trigger':170C,235C 'two':175C 'unauthent':172C,230C,242C 'unchang':113C 'unseri':37B,129C 'use':184C 'user':65B,209C 'valu':30B,97C,127C 'version':78C,255C 'vulner':158C 'web':63B,207C 'web-serv':62B,206C 'websit':74C 'widget':3A,28B,88C,92C,152C 'widget-area':27B,87C 'widget-writ':151C 'without':130C 'write':153C 'xss':162C","nicknames":[],"mitigations":[],"who_affected":"Sites running baserCMS 5.0.0 through 5.3.x before 5.3.2, or 5.4.0 through 5.4.x before 5.4.2, are exposed. Exploitation requires an administrator or an attacker with widget-write access, such as one obtained through chained XSS, to store the payload first, but the trigger is then ordinary unauthenticated page requests. Sites already on `5.3.2` or `5.4.2` or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114624","severity":null,"published_at":"2026-10-23T14:17:51+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114624","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114624","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}