CVE-2026-21861CWE-78

baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)

Critical · published March 31, 2026

CVSS v3.1
9.1
EPSS
2%
Percentile
83.0
In the wild
Unconfirmed
What it is

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02282 · 83.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-31T00:43Z
EPSS history
Timeline
  • 31 MAR 00:43Z
    baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)
    cvelistv5