CVE-2026-97150CWE-829

CVE-2026-97150

High · published September 30, 2026

CVSS v3.0
7.2
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

When converting baserCMS4-style addons to baserCMS5-style ones,

BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed.

Arbitrary files on the system may be read or deleted by an administrative user.

The record
Technical detail
CVSS v3.0
7.2 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00336 · 25.8th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-09-30T12:16Z
References (3)
https://basercms.net/security/JVN_21754394 · [email protected]https://github.com/baserproject/BcAddonMigrator/commit/e836bc875e26910e1b5862f96cf280b4f064c104 · [email protected]https://jvn.jp/en/jp/JVN21754394 · [email protected]
EPSS history
Timeline
  • 01 OCT 03:50Z
    EPSS moved — → 0%
    epss
  • 30 SEP 07:12Z
    When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is…
    cvelistv5