Live › vulnerability › CVE-2026-115481
Go to dashboardbaserCMS builds a wildcard allow rule for any plugin that lacks a config/permission.php file, so non-admin groups gain access to every URL under that plugin. The BcCustomContent plugin ships without that file, so after an administrator installs it the default operators group can store and run arbitrary PHP on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running baserCMS 5.0.0-beta1 up to but not including 5.3.2 or 5.4.2 that have installed the BcCustomContent plugin. The plugin has to be installed by an administrator before the flaw applies, and the exposure comes from the default operators group being able to reach its wildcard rule. Sites without that plugin installed are not affected by this specific path.
No product ranges from the sources yet.
bin/cake baser version or the admin footer; versions below 5.3.2 on the 5.3 line or below 5.4.2 on the 5.4 line are exposed.plugins/BcCustomContent under the baserCMS root.operators group permissions in the admin for any wildcard rule under /baser/<prefix>/bc-custom-content/*.5.3.2 (5.3 line) or 5.4.2 (5.4 line) or later.operators group's access to its URLs.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build() reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url /baser/<prefix>/<plugin>/*, method *, auth true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default operators group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-115481")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.