GHSA-m9g7-rgfc-jcm7

Suggest an improvement
Source
https://github.com/advisories/GHSA-m9g7-rgfc-jcm7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-m9g7-rgfc-jcm7/GHSA-m9g7-rgfc-jcm7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m9g7-rgfc-jcm7
Aliases
Published
2026-03-31T22:35:47Z
Modified
2026-09-10T03:50:39Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
baserCMS Update Functionality Vulnerable to OS Command Injection
Details

Summary

The latest version of baserCMS (basercms-5.2.2) contains an OS command injection vulnerability (CWE-78) in its update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS.

Details

Please refer to the attached materials. OSコマンドインジェクション（baserCMSのアップデート機能）.pdf

Impact

An authenticated user with administrator privileges in baserCMS can execute OS commands on the server with the privileges of the user account running baserCMS.

Database specific 
{
    "cwe_ids":  [
        "CWE-78"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-31T22:35:47Z",
    "nvd_published_at":  "2026-03-31T01:16:35Z",
    "severity":  "CRITICAL"
}
References

Affected packages

Packagist / baserproject/basercms

Package

Name
baserproject/basercms
Purl
pkg:composer/baserproject/basercms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.2.3

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
1.*
1.0.0
2.*
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
2.0.0-rc5
2.0.0-rc6
3.*
3.0.7
3.0.7.1
3.0.8
3.0.8.1
3.0.9
3.0.9.1
3.0.10
3.0.10.1
3.0.11
3.0.11.1
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.0.19
3.0.20
3.0.21
3.0.22
3.0.23
3.0.24
3.0.25
3.0.26
4.*
4.0.0-beta
4.0.0
4.0.1
4.0.2
4.0.2.1
4.0.3
4.0.4
4.0.5
4.0.5.1
4.0.5.2
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.0.10.1
4.0.11
4.1.0
4.1.0.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.7.1
4.4.0
4.4.1
4.4.1.1
4.4.2
4.4.2.1
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.6.0
4.6.1
4.6.1.1
4.6.2
4.6.3
4.7.0
4.7.2
4.7.3
4.7.5
4.7.6
4.7.7
4.7.8
4.8.0
4.8.1
4.8.2
4.8.3
5.*
5.0.0-beta1
5.0.0-beta2
5.0.0-beta3
5.0.0-beta4
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10
5.0.11
5.0.12
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.20
5.0.21
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.1.10
5.2.0
5.2.1
5.2.2

Database specific

last_known_affected_version_range 
"<= 5.2.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-m9g7-rgfc-jcm7/GHSA-m9g7-rgfc-jcm7.json"