Vulnerability Report

CVE-2026-21861

RCE

Title: baserCMS OS command injection in core update

RCE

Proof Of Concept

No public PoC currently indexed for CVE-2026-21861.

CWE Category CWE-78

Published Date Mar 31, 2026

Modified Date Apr 01, 2026

Exploit Status Not Found

Score 9.1 CVSS v3.1

Exploit Probability (EPSS)

2.28%

Vulnerability Summary

CVE-2026-21861: baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.

Impacted Vendors

basercms 1

Reference Links

https://basercms.net/security/JVN_20837860 https://github.com/baserproject/basercms/releases/tag/5.2.3 https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

9.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H