CVE-2026-114622: baserCMS BcThemeFile plugin path traversal in API

CVE-2026-114622 · Severity: high · CVSS 7.2 · Published 2026-10-23

baserCMS is a website development framework that includes a BcThemeFile plugin allowing administrators to manage theme template files. An authentication bypass in the optional plugin's Admin API allows authenticated administrators to write PHP files outside the intended theme directory by using percent-encoded path traversal characters, potentially enabling remote code execution on the web server.

Technologies: Baserproject baserCMS. Vendors: Baserproject.

Quick answers

Is CVE-2026-114622 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114622 being exploited in the wild.
How severe is CVE-2026-114622?
High severity, with a CVSS score of 7.2, published 23 October 2026.
Which products and versions are affected?
Baserproject baserCMS 5.2.3 before 5.3.2, 5.4.0 before 5.4.2.
Is there a fix for CVE-2026-114622?
Yes: fixed in 5.3.2, 5.4.2. Until then: Disable the optional BcThemeFile plugin if it is not needed. Restrict Admin API access to trusted administrator IP ranges and ensure administrator accounts use strong authentication. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114622 attacked?
It is attacked over the network.
Am I affected by CVE-2026-114622?
Check whether you run Baserproject baserCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 5.3.2, 5.4.2

Disable the optional BcThemeFile plugin if it is not needed. Restrict Admin API access to trusted administrator IP ranges and ensure administrator accounts use strong authentication.

Technical details

The vulnerability exists in ThemeFilesService::update() and getFullpath() which validate path containment before rawurldecode() is applied, but ThemeFileForm::_execute() applies rawurldecode() after validation. This allows percent-encoded traversal sequences (e.g., %2e%2e) to bypass normalizePath() checks and escape the theme directory boundary. An authenticated administrator with session access can write arbitrary PHP files to writable locations like webroot. The attack requires the non-default BcThemeFile plugin enabled and same-origin requests; FormProtection prevents the attack via the web admin form but not the Admin API.

Affected products

  • baserproject baserCMS 5.2.3 before 5.3.2, 5.4.0 before 5.4.2

Timeline

  • 2026-10-23: disclosed
  • 2026-10-22: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.