---
id: "CVE-2026-115481"
kind: "vulnerability"
aliases: ["CVE-2026-115481"]
title: "baserCMS: missing plugin permission file grants operators arbitrary PHP execution"
severity: "high"
cvss: 8.5
epss: 0.00466
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["basercms", "cms", "package", "php", "self-hosted"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-10-23T14:17:52+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115481", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115481", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# baserCMS: missing plugin permission file grants operators arbitrary PHP execution

baserCMS builds a wildcard allow rule for any plugin that lacks a config/permission.php file, so non-admin groups gain access to every URL under that plugin. The BcCustomContent plugin ships without that file, so after an administrator installs it the default operators group can store and run arbitrary PHP on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed baserCMS version with `bin/cake baser version` or the admin footer; versions below `5.3.2` on the 5.3 line or below `5.4.2` on the 5.4 line are exposed.
- Check whether the BcCustomContent plugin is installed by looking for `plugins/BcCustomContent` under the baserCMS root.
- Review the `operators` group permissions in the admin for any wildcard rule under `/baser/<prefix>/bc-custom-content/*`.

## Fix

- Upgrade baserCMS to `5.3.2` (5.3 line) or `5.4.2` (5.4 line) or later.
- Until upgraded, remove the BcCustomContent plugin or restrict the `operators` group's access to its URLs.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115481
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115481

## From the sources

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_