---
id: "CVE-2026-114624"
kind: "vulnerability"
aliases: ["CVE-2026-114624"]
title: "baserCMS: stored widget data deserialized, enabling command execution on page load"
severity: "high"
cvss: 7.2
epss: 0.00922
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["basercms", "cms", "php", "runtime", "self-hosted"]
not_affected_if: ["no-widget-write-access", "patched-5.3.2-or-5.4.2"]
published_at: "2026-10-23T14:17:51+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114624", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114624", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# baserCMS: stored widget data deserialized, enabling command execution on page load

baserCMS stores widget-area values that are later read back with unserialize() and no class restrictions. A stored serialized payload can reach proc_open() through composer or MCP SDK gadget chains and run commands as the web-server user each time the page renders.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the baserCMS version: affected versions are `5.0.0` to before `5.3.2` and `5.4.0` to before `5.4.2`.
- Look for `composer/composer` and `logiscape/mcp-sdk-php` in `composer.lock`, since the demonstrated gadget chains use them.
- Inspect the widget-area database rows for serialized or base64-encoded PHP data.

## Fix

- Upgrade baserCMS to `5.3.2` on the 5.3 line or `5.4.2` on the 5.4 line.
- After upgrading, repair any widget-area database rows that hold serialized data, because the description says a stored payload keeps executing until its row is repaired.
- Review admin accounts and widget-write permissions.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114624
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114624

## From the sources

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests. Two demonstrated gadget chains in the default dependency set use composer/composer ProcessExecutor::startJob() with Process::fromShellCommandline(), or logiscape/mcp-sdk-php StdioTransport::connect() with StdioServerParameters, to reach proc_open() and execute commands as the web-server user. Deserialization bypasses constructor-based readonly safeguards, and the stored payload can execute repeatedly until the database row is repaired. Unauthenticated page access is a trigger after privileged payload storage, not an unauthenticated means of initially planting the payload. This issue has been patched in versions 5.3.2 and 5.4.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_