Vulnerability-Lookup

CVE-2026-21861 (GCVE-0-2026-21861)

Vulnerability from cvelistv5 – Published: 2026-03-31 00:43 – Updated: 2026-03-31 14:01

Title

baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)

Summary

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.

Severity ?

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/baserproject/basercms/security…	x_refsource_CONFIRM
	https://basercms.net/security/JVN_20837860	x_refsource_MISC
	https://github.com/baserproject/basercms/releases…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	baserproject	basercms	Affected: < 5.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21861",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T14:01:36.891582Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T14:01:39.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "basercms",
          "vendor": "baserproject",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T00:43:58.296Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g"
        },
        {
          "name": "https://basercms.net/security/JVN_20837860",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://basercms.net/security/JVN_20837860"
        },
        {
          "name": "https://github.com/baserproject/basercms/releases/tag/5.2.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/baserproject/basercms/releases/tag/5.2.3"
        }
      ],
      "source": {
        "advisory": "GHSA-qxmc-6f24-g86g",
        "discovery": "UNKNOWN"
      },
      "title": "baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-21861",
    "datePublished": "2026-03-31T00:43:58.296Z",
    "dateReserved": "2026-01-05T16:44:16.367Z",
    "dateUpdated": "2026-03-31T14:01:39.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-21861\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-31T01:16:35.540\",\"lastModified\":\"2026-04-01T20:29:39.303\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.\"},{\"lang\":\"es\",\"value\":\"baserCMS es un framework de desarrollo de sitios web. Antes de la versi\u00f3n 5.2.3, baserCMS contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en la funcionalidad de actualizaci\u00f3n del n\u00facleo. Un administrador autenticado puede ejecutar comandos arbitrarios del sistema operativo en el servidor debido a un manejo inadecuado de la entrada controlada por el usuario que se pasa directamente a exec() sin suficiente validaci\u00f3n o escape. Este problema ha sido parcheado en la versi\u00f3n 5.2.3.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.2.3\",\"matchCriteriaId\":\"07DEEEF3-0621-431D-8A38-405EDBD0957E\"}]}]}],\"references\":[{\"url\":\"https://basercms.net/security/JVN_20837860\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/baserproject/basercms/releases/tag/5.2.3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-21861\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-31T14:01:36.891582Z\"}}}], \"references\": [{\"url\": \"https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-31T14:01:31.684Z\"}}], \"cna\": {\"title\": \"baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)\", \"source\": {\"advisory\": \"GHSA-qxmc-6f24-g86g\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"baserproject\", \"product\": \"basercms\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 5.2.3\"}]}], \"references\": [{\"url\": \"https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g\", \"name\": \"https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://basercms.net/security/JVN_20837860\", \"name\": \"https://basercms.net/security/JVN_20837860\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/baserproject/basercms/releases/tag/5.2.3\", \"name\": \"https://github.com/baserproject/basercms/releases/tag/5.2.3\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-31T00:43:58.296Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-21861\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-31T14:01:39.730Z\", \"dateReserved\": \"2026-01-05T16:44:16.367Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-31T00:43:58.296Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-21861

Vulnerability from fkie_nvd - Published: 2026-03-31 01:16 - Updated: 2026-04-01 14:24

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://basercms.net/security/JVN_20837860
	security-advisories@github.com	https://github.com/baserproject/basercms/releases/tag/5.2.3
	security-advisories@github.com	https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3."
    },
    {
      "lang": "es",
      "value": "baserCMS es un framework de desarrollo de sitios web. Antes de la versi\u00f3n 5.2.3, baserCMS contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en la funcionalidad de actualizaci\u00f3n del n\u00facleo. Un administrador autenticado puede ejecutar comandos arbitrarios del sistema operativo en el servidor debido a un manejo inadecuado de la entrada controlada por el usuario que se pasa directamente a exec() sin suficiente validaci\u00f3n o escape. Este problema ha sido parcheado en la versi\u00f3n 5.2.3."
    }
  ],
  "id": "CVE-2026-21861",
  "lastModified": "2026-04-01T14:24:02.583",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-31T01:16:35.540",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://basercms.net/security/JVN_20837860"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/baserproject/basercms/releases/tag/5.2.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-QXMC-6F24-G86G

Vulnerability from github – Published: 2026-03-31 22:27 – Updated: 2026-03-31 22:27

Summary

baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)

Details

Summary

In the core update functionality of baserCMS, some parameters sent from the admin panel are passed to the exec() function without proper validation or escaping. This issue allows an authenticated CMS administrator to execute arbitrary OS commands on the server (Remote Code Execution, RCE).

This vulnerability is not a UI-level issue such as screen manipulation or lack of CSRF protection, but rather stems from a design that directly executes input values received on the server side as OS commands. Therefore, even if buttons are hidden in the UI, or even if CakePHP's CSRF/FormProtection (SecurityComponent) ensures that only legitimate POST requests are accepted, an attack is possible as long as a request containing a valid token is processed within an administrator session.

Vulnerability Information

Item	Details
CWE	CWE-78: Improper Neutralization of Special Elements used in an OS Command
Impact	Remote Code Execution (RCE)
Severity	Critical
Attack Requirements	Administrator privileges required
Reproducibility	Reproducible (confirmed multiple times)
Test Environment	baserCMS 5.2.2 (Docker / development environment)

Affected Areas

Controller
PluginsController::get_core_update()
Service
PluginsService::getCoreUpdate()
Affected Endpoint
/baser/admin/baser-core/plugins/get_core_update

Technical Details

Vulnerable Code Flow

PluginsController::get_core_update()
  ↓ Retrieves php parameter from POST data
PluginsService::getCoreUpdate($targetVersion, $php, $force)
  ↓ Concatenates $php into command string without validation or escaping
exec($command)

Relevant Code (Excerpt)

PluginsController.php

$service->getCoreUpdate(
    $request->getData('targetVersion') ?? '',
    $request->getData('php') ?? 'php',
    $request->getData('force'),
);

PluginsService.php

$command = $php . ' ' . ROOT . DS . 'bin' . DS . 'cake.php composer ' .
           $targetVersion . ' --php ' . $php . ' --dir ' . TMP . 'update';

exec($command, $out, $code);

The $php parameter is user input, and none of the following countermeasures are in place:

Restriction via allowlist
Validation via regular expression
Escaping via escapeshellarg() or similar

Attack Scenario

The attacker logs in as a CMS administrator
Sends a POST request to the core update functionality in the admin panel
Specifies a string containing OS commands in the php parameter
exec() is executed on the server side, running the arbitrary OS command

Example Attack Input (Conceptual)

php=php;id>/tmp/rce_test;#

Verification Results (PoC)

Execution Result

$ docker exec bc-php cat /tmp/rce_test
uid=1000(www-data) gid=1000(www-data) groups=1000(www-data)

The above confirms that OS commands can be executed with www-data privileges.

Additional Notes

Reproducible through the legitimate flow in the admin panel (browser)
Succeeds even with CSRF/FormProtection tokens included in a legitimate request
Failure cases (400/403) have also been investigated and differentiated
Confirmed reproducible via resending HTTP requests with tools such as curl (resending the same request containing valid tokens)

Impact

If this vulnerability is exploited, the following becomes possible:

Retrieval of server information
Reading/writing arbitrary files
Retrieval of application configuration information (DB credentials, etc.)
OS-level operations beyond application permission boundaries

Although administrator privileges are required, this is a design issue where the impact extends from the application layer to the OS layer, and the impact is considered significant.

Recommended Fix

Primary Recommendation

Do not accept the PHP executable path from user input
Fix the PHP executable on the server side using the PHP_BINARY constant

$php = escapeshellarg(PHP_BINARY);

Supplementary Fix Recommendations

Apply escapeshellarg() escaping to other command-line arguments (version number, directory, etc.) as well
If possible, consider using execution methods that do not involve shell interpretation (array format, Process class, etc.)

Alternative (Not Recommended)

Allowlist validation for the PHP executable path
Combined use of regex validation and escapeshellarg()

However, from the perspective of reducing the attack surface, a design that eliminates user input entirely is recommended.

Additional Notes

This issue is independent of UI display controls (showing/hiding buttons)
As long as the endpoint exists, an attack is possible if a request containing valid tokens is processed
This is a problem stemming from the design-level handling of input, and cannot be prevented by CSRF or UI controls alone

Conclusion

Due to a design issue in baserCMS's core update functionality where user input is passed to exec() without validation, Remote Code Execution (RCE) is achievable with administrator privileges. This vulnerability can be fixed through input validation and design review, and prompt remediation is recommended.

This advisory was translated from Japanese to English using GitHub Copilot.

Severity ?

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.2.2"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "baserproject/basercms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-21861"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-31T22:27:05Z",
    "nvd_published_at": "2026-03-31T01:16:35Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nIn the core update functionality of baserCMS, some parameters sent from the admin panel are passed to the `exec()` function without proper validation or escaping. This issue allows **an authenticated CMS administrator to execute arbitrary OS commands on the server (Remote Code Execution, RCE)**.\n\nThis vulnerability is not a UI-level issue such as screen manipulation or lack of CSRF protection, but rather stems from **a design that directly executes input values received on the server side as OS commands**. Therefore, even if buttons are hidden in the UI, or even if CakePHP\u0027s CSRF/FormProtection (SecurityComponent) ensures that only legitimate POST requests are accepted, **an attack is possible as long as a request containing a valid token is processed within an administrator session**.\n\n---\n\n## Vulnerability Information\n\n| Item | Details |\n| ---- | ------- |\n| CWE | CWE-78: Improper Neutralization of Special Elements used in an OS Command |\n| Impact | Remote Code Execution (RCE) |\n| Severity | Critical |\n| Attack Requirements | Administrator privileges required |\n| Reproducibility | Reproducible (confirmed multiple times) |\n| Test Environment | baserCMS 5.2.2 (Docker / development environment) |\n\n---\n\n## Affected Areas\n\n- **Controller**\n  - `PluginsController::get_core_update()`\n- **Service**\n  - `PluginsService::getCoreUpdate()`\n- **Affected Endpoint**\n  - `/baser/admin/baser-core/plugins/get_core_update`\n\n---\n\n## Technical Details\n\n### Vulnerable Code Flow\n\n```text\nPluginsController::get_core_update()\n  \u2193 Retrieves php parameter from POST data\nPluginsService::getCoreUpdate($targetVersion, $php, $force)\n  \u2193 Concatenates $php into command string without validation or escaping\nexec($command)\n```\n\n### Relevant Code (Excerpt)\n\n**PluginsController.php**\n\n```php\n$service-\u003egetCoreUpdate(\n    $request-\u003egetData(\u0027targetVersion\u0027) ?? \u0027\u0027,\n    $request-\u003egetData(\u0027php\u0027) ?? \u0027php\u0027,\n    $request-\u003egetData(\u0027force\u0027),\n);\n```\n\n**PluginsService.php**\n\n```php\n$command = $php . \u0027 \u0027 . ROOT . DS . \u0027bin\u0027 . DS . \u0027cake.php composer \u0027 .\n           $targetVersion . \u0027 --php \u0027 . $php . \u0027 --dir \u0027 . TMP . \u0027update\u0027;\n\nexec($command, $out, $code);\n```\n\nThe `$php` parameter is user input, and **none** of the following countermeasures are in place:\n\n- Restriction via allowlist\n- Validation via regular expression\n- Escaping via `escapeshellarg()` or similar\n\n---\n\n## Attack Scenario\n\n1. The attacker logs in as a CMS administrator\n2. Sends a POST request to the core update functionality in the admin panel\n3. Specifies a string containing OS commands in the `php` parameter\n4. `exec()` is executed on the server side, running the arbitrary OS command\n\n### Example Attack Input (Conceptual)\n\n```text\nphp=php;id\u003e/tmp/rce_test;#\n```\n\n---\n\n## Verification Results (PoC)\n\n### Execution Result\n\n```bash\n$ docker exec bc-php cat /tmp/rce_test\nuid=1000(www-data) gid=1000(www-data) groups=1000(www-data)\n```\n\nThe above confirms that OS commands can be executed with `www-data` privileges.\n\n### Additional Notes\n\n- Reproducible through the legitimate flow in the admin panel (browser)\n- Succeeds even with CSRF/FormProtection tokens included in a legitimate request\n- Failure cases (400/403) have also been investigated and differentiated\n- Confirmed reproducible via resending HTTP requests with tools such as curl (resending the same request containing valid tokens)\n\n---\n\n## Impact\n\nIf this vulnerability is exploited, the following becomes possible:\n\n- Retrieval of server information\n- Reading/writing arbitrary files\n- Retrieval of application configuration information (DB credentials, etc.)\n- OS-level operations beyond application permission boundaries\n\nAlthough administrator privileges are required, **this is a design issue where the impact extends from the application layer to the OS layer**, and the impact is considered significant.\n\n---\n\n## Recommended Fix\n\n### Primary Recommendation\n\n- Do not accept the PHP executable path from user input\n- Fix the PHP executable on the server side using the `PHP_BINARY` constant\n\n```php\n$php = escapeshellarg(PHP_BINARY);\n```\n\n### Supplementary Fix Recommendations\n\n- Apply `escapeshellarg()` escaping to other command-line arguments (version number, directory, etc.) as well\n- If possible, consider using execution methods that do not involve shell interpretation (array format, Process class, etc.)\n\n### Alternative (Not Recommended)\n\n- Allowlist validation for the PHP executable path\n- Combined use of regex validation and `escapeshellarg()`\n\nHowever, **from the perspective of reducing the attack surface, a design that eliminates user input entirely is recommended**.\n\n---\n\n## Additional Notes\n\n- This issue is independent of UI display controls (showing/hiding buttons)\n- As long as the endpoint exists, an attack is possible if a request containing valid tokens is processed\n- This is a problem stemming from the design-level handling of input, and cannot be prevented by CSRF or UI controls alone\n\n---\n\n## Conclusion\n\nDue to a design issue in baserCMS\u0027s core update functionality where user input is passed to `exec()` without validation, **Remote Code Execution (RCE) is achievable with administrator privileges**. This vulnerability can be fixed through input validation and design review, and prompt remediation is recommended.\n\nThis advisory was translated from Japanese to English using GitHub Copilot.",
  "id": "GHSA-qxmc-6f24-g86g",
  "modified": "2026-03-31T22:27:05Z",
  "published": "2026-03-31T22:27:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21861"
    },
    {
      "type": "WEB",
      "url": "https://basercms.net/security/JVN_20837860"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/baserproject/basercms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/baserproject/basercms/releases/tag/5.2.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-21861 (GCVE-0-2026-21861)

FKIE_CVE-2026-21861

GHSA-QXMC-6F24-G86G

Summary

Vulnerability Information

Affected Areas

Technical Details

Vulnerable Code Flow

Relevant Code (Excerpt)

Attack Scenario

Example Attack Input (Conceptual)

Verification Results (PoC)

Execution Result

Additional Notes

Impact

Recommended Fix

Primary Recommendation

Supplementary Fix Recommendations

Alternative (Not Recommended)

Additional Notes

Conclusion

Tags

Sightings

Nomenclature