CVE-2026-21861: RCE in baserproject/basercms

The impact of CVE-2026-21861 is severe. An attacker who can successfully exploit this vulnerability gains complete control over the server hosting the basercms installation. This includes the ability to read, modify, and delete files, install malware, and pivot to other systems on the network. The direct execution of user-supplied input as OS commands bypasses standard security controls like CSRF protection, making exploitation relatively straightforward for an authenticated administrator. The blast radius extends to any data stored on the server and any systems accessible from the compromised server, potentially impacting sensitive customer data and critical business operations. This vulnerability shares similarities with other RCE flaws where unsanitized input is directly passed to system commands, allowing for arbitrary code execution.

1. Reserved2026-01-05
2. Published2026-03-31
3. EPSS updated2026-04-07

The primary mitigation for CVE-2026-21861 is to immediately upgrade basercms to version 5.2.3 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. While a direct fix is the preferred approach, restricting access to the core update functionality within the admin panel can limit the attack surface. Implement strict input validation and sanitization on all parameters passed to the exec() function. Web Application Firewalls (WAFs) configured to detect and block suspicious command execution attempts can provide an additional layer of defense. Monitor basercms logs for unusual activity, particularly attempts to access or modify core update parameters. After upgrading, confirm the fix by attempting to trigger the core update functionality with malicious input and verifying that the command is not executed.

Last updated

5.2.3recently