GHSA-6hpg-8rx3-cwgv

Suggest an improvement
Source
https://github.com/advisories/GHSA-6hpg-8rx3-cwgv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6hpg-8rx3-cwgv/GHSA-6hpg-8rx3-cwgv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6hpg-8rx3-cwgv
Aliases
Published
2026-03-31T22:43:31Z
Modified
2026-03-31T23:05:55.948714Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
baserCMS has OS command injection vulnerability in installer
Details

baserCMS has an OS command injection vulnerability in the installer.

Target

baserCMS 5.2.2 and earlier versions

Vulnerability

If baserCMS is placed on a server but not installed, malicious commands may be executed.

Countermeasures

Update to the latest version of baserCMS

Please refer to the following page to reference for more information. https://basercms.net/security/JVN_54513170

Credits

REN XINGDIAN

Database specific 
{
    "nvd_published_at": "2026-03-31T01:16:36Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-78"
    ],
    "github_reviewed_at": "2026-03-31T22:43:31Z"
}
References

Affected packages

Packagist / baserproject/basercms

Package

Name
baserproject/basercms
Purl
pkg:composer/baserproject/basercms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.2.3

Affected versions

2.*
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
2.0.0-rc5
2.0.0-rc6
3.*
3.0.7
3.0.7.1
3.0.8
3.0.8.1
3.0.9
3.0.9.1
3.0.10
3.0.10.1
3.0.11
3.0.11.1
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.0.19
3.0.20
3.0.21
3.0.22
3.0.23
3.0.24
3.0.25
3.0.26
4.*
4.0.0-beta
4.0.0
4.0.1
4.0.2
4.0.2.1
4.0.3
4.0.4
4.0.5
4.0.5.1
4.0.5.2
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.0.10.1
4.0.11
4.1.0
4.1.0.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.7.1
4.4.0
4.4.1
4.4.1.1
4.4.2
4.4.2.1
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.6.0
4.6.1
4.6.1.1
4.6.2
4.6.3
4.7.0
4.7.2
4.7.3
4.7.5
4.7.6
4.7.7
4.7.8
4.8.0
4.8.1
4.8.2
5.*
5.0.0-beta1
5.0.0-beta2
5.0.0-beta3
5.0.0-beta4
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10
5.0.11
5.0.12
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.20
5.0.21
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.1.10
5.2.0
5.2.1
5.2.2

Database specific

last_known_affected_version_range 
"<= 5.2.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6hpg-8rx3-cwgv/GHSA-6hpg-8rx3-cwgv.json"