{"id":"CVE-2026-115479","kind":"vulnerability","aliases":["CVE-2026-115479"],"related":[],"title":"baserCMS: public mail form lets visitors send auto-replies to many addresses","description":"baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties. MailMessageMailer::sendFormToUser() passes the visitor-controlled userMail value to parseAndNormalizeMailAddresses(), which splits it with explode(',') and supplies every resulting address to setTo(). Newly created forms with an email-type field are affected when the separate, optional VALID_EMAIL server-side validation is not enabled; browser type=email validation does not prevent crafted requests. The bundled contact form enables VALID_EMAIL and is not affected. The auto-reply uses the site's sender identity and includes partially attacker-controlled content, allowing abuse of the site to deliver unsolicited mail. This issue has been patched in versions 5.3.2 and 5.4.2.","summary":"A visitor can enter a comma-separated list of addresses in a public form's email field, and baserCMS sends the auto-reply to all of them from the site's sender address. An attacker can use the site to deliver unsolicited mail to third parties.","severity":"medium","cvss":5.3,"epss":0.00412,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["basercms","mail","package","php","self-hosted"],"not_affected_if":["default-config","valid-email-enabled"],"how_to_check":"- Check the baserCMS version: `5.2.5` through `5.3.1` and `5.4.0` through `5.4.1` are affected.\n- Check whether forms with an email-type field have the VALID_EMAIL server-side validation enabled; forms without it are exposed.\n- The bundled contact form enables VALID_EMAIL and is not affected.","fix":"- Upgrade baserCMS to `5.3.2` (5.3 line) or `5.4.2` (5.4 line).\n- Until upgraded, enable VALID_EMAIL validation on any public form with an email-type field.","status":"open","published_at":"2026-10-23T14:17:52+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:18:57+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:18:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade baserCMS to `5.3.2` (5.3 line) or `5.4.2` (5.4 line).\n- Until upgraded, enable VALID_EMAIL validation on any public form with an email-type field.","reach":"internet","title":"baserCMS: public mail form lets visitors send auto-replies to many addresses","impact":"low","summary":"A visitor can enter a comma-separated list of addresses in a public form's email field, and baserCMS sends the auto-reply to all of them from the site's sender address. An attacker can use the site to deliver unsolicited mail to third parties.","category":"package","nicknames":[],"who_cares":["basercms","php","self-hosted","mail"],"confidence":0.8,"needs_auth":"no","worst_case":"Site sends unsolicited auto-reply mail to many third-party addresses","analyst_note":"","how_to_check":"- Check the baserCMS version: `5.2.5` through `5.3.1` and `5.4.0` through `5.4.1` are affected.\n- Check whether forms with an email-type field have the VALID_EMAIL server-side validation enabled; forms without it are exposed.\n- The bundled contact form enables VALID_EMAIL and is not affected.","needs_analyst":false,"not_affected_if":["default-config","valid-email-enabled"],"who_is_affected":"Sites running baserCMS 5.2.5 to before 5.3.2 or 5.4.0 to before 5.4.2 that have a public mail form with an email-type field where server-side VALID_EMAIL validation is not enabled. Newly created forms with an email field are the main risk. Sites that only use the bundled contact form, or that have VALID_EMAIL enabled, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":3523,"output_tokens":630,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115479':16A,19A '-2026':15A,18A '5.2.5':83C '5.3.2':85C,223C '5.4.0':87C '5.4.2':89C,225C 'abus':208C 'address':13A,37B,61B,99C,118C,143C 'affect':156C,189C 'allow':207C 'attack':63B,204C 'attacker-control':203C 'auto':9A,50B,114C,192C 'auto-repli':8A,49B,113C,191C 'basercm':1A,20B,46B,75C 'browser':170C 'bundl':180C 'caus':110C 'comma':33B,97C 'comma-separ':32B,96C 'contact':181C 'content':206C 'control':129C,205C 'craft':177C 'creat':147C 'cve':14A,17A 'deliv':69B,213C 'develop':79C 'email':43B,107C,152C,162C,172C,185C 'email-typ':151C 'enabl':169C,183C 'enter':30B 'everi':141C 'explod':138C 'field':44B,108C,154C 'form':4A,41B,105C,148C,182C 'framework':80C 'host':26B 'ident':199C 'includ':201C 'issu':217C 'let':5A 'list':35B,100C 'mail':3A,21B,71B,104C,215C 'mailmessagemail':123C 'mani':12A 'multipl':120C 'newli':146C 'option':160C 'packag':22B 'parseandnormalizemailaddress':133C 'parti':74B,122C 'partial':202C 'pass':125C 'patch':220C 'php':23B 'prevent':176C 'public':2A,40B,103C 'repli':10A,51B,115C,193C 'request':178C 'result':142C 'self':25B 'self-host':24B 'send':7A,47B 'sender':60B,198C 'sendformtous':124C 'separ':34B,98C,159C 'server':164C 'server-sid':163C 'setto':145C 'side':165C 'singl':112C 'site':58B,67B,196C,211C 'split':135C 'suppli':94C,140C 'third':73B,121C 'type':153C,171C 'unauthent':91C 'unsolicit':70B,214C 'use':65B,194C 'usermail':130C 'valid':161C,166C,173C,184C 'valu':131C 'version':82C,222C 'visitor':6A,28B,92C,128C 'visitor-control':127C 'websit':78C","nicknames":[],"mitigations":[],"who_affected":"Sites running baserCMS 5.2.5 to before 5.3.2 or 5.4.0 to before 5.4.2 that have a public mail form with an email-type field where server-side VALID_EMAIL validation is not enabled. Newly created forms with an email field are the main risk. Sites that only use the bundled contact form, or that have VALID_EMAIL enabled, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115479","severity":null,"published_at":"2026-10-23T14:17:52+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115479","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115479","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}