Live › vulnerability › CVE-2026-115479
Go to dashboardA visitor can enter a comma-separated list of addresses in a public form's email field, and baserCMS sends the auto-reply to all of them from the site's sender address. An attacker can use the site to deliver unsolicited mail to third parties.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running baserCMS 5.2.5 to before 5.3.2 or 5.4.0 to before 5.4.2 that have a public mail form with an email-type field where server-side VALID_EMAIL validation is not enabled. Newly created forms with an email field are the main risk. Sites that only use the bundled contact form, or that have VALID_EMAIL enabled, are not affected.
No product ranges from the sources yet.
5.2.5 through 5.3.1 and 5.4.0 through 5.4.1 are affected.5.3.2 (5.3 line) or 5.4.2 (5.4 line).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties. MailMessageMailer::sendFormToUser() passes the visitor-controlled userMail value to parseAndNormalizeMailAddresses(), which splits it with explode(',') and supplies every resulting address to setTo(). Newly created forms with an email-type field are affected when the separate, optional VALID_EMAIL server-side validation is not enabled; browser type=email validation does not prevent crafted requests. The bundled contact form enables VALID_EMAIL and is not affected. The auto-reply uses the site's sender identity and includes partially attacker-controlled content, allowing abuse of the site to deliver unsolicited mail. This issue has been patched in versions 5.3.2 and 5.4.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-115479")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.