Vulnerability Report

CVE-2025-32957

RCE

Title: baserCMS Arbitrary code execution via restore function

RCE

Proof Of Concept

PoC Available for CVE-2025-32957

CWE Category CWE-434

Published Date Mar 31, 2026

Modified Date Apr 01, 2026

Exploit Status Available

Score 8.7 CVSS v3.1

Exploit Probability (EPSS)

0.58%

Vulnerability Summary

CVE-2025-32957: baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.

Impacted Vendors

basercms 1

Reference Links

https://basercms.net/security/JVN_20837860 https://github.com/baserproject/basercms/releases/tag/5.2.3 https://github.com/baserproject/basercms/security/advisories/GHSA-hv78-cwp4-8r7r

CVSS v3.1

Source Entity [email protected]

Severity HIGH

8.7

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N