# CVE-2026-114623: baserCMS path traversal in BcThemeFile plugin admin interface

Source: https://junglewise.ai/threats/cve-2026-114623-basercms-is-a-website-development-framework-in-versions-5-0-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-114623 · Severity: medium · CVSS 6.5 · Published 2026-10-23

baserCMS is a website development framework that manages website themes and content. An authenticated user with minimal theme-file viewing permissions can exploit a path traversal flaw in the optional BcThemeFile plugin to read arbitrary files outside the theme directory, including application source code and database configuration files containing credentials. The plugin is disabled by default, but if enabled, this vulnerability allows disclosure of sensitive configuration data without requiring additional authorization checks.

Technologies: [Baserproject baserCMS](https://junglewise.ai/threats/technologies/baserproject-basercms-1). Vendors: [Baserproject](https://junglewise.ai/threats/vendors/baserproject).

## Quick answers

**Is CVE-2026-114623 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114623 being exploited in the wild.

**How severe is CVE-2026-114623?** Medium severity, with a CVSS score of 6.5, published 23 October 2026.

**Which products and versions are affected?** Baserproject baserCMS 5.0.0 before 5.3.2, 5.4.0 before 5.4.2.

**Is there a fix for CVE-2026-114623?** Yes: fixed in 5.3.2, 5.4.2. Until then: Disable the BcThemeFile plugin if it is not required, or restrict access to the theme administration interface to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114623 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114623?** Check whether you run Baserproject baserCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.3.2, 5.4.2

Disable the BcThemeFile plugin if it is not required, or restrict access to the theme administration interface to trusted users only.

## Technical details

The BcThemeFile plugin's ThemeFilesController::parseArgs() constructs file paths with literal ../ segments, and the view and edit actions pass unvalidated paths to ThemeFilesService::get(), which reads and exposes file contents in a textarea without containment validation. The authorization system checks the unresolved request path before the file resolution occurs, allowing the bypass. File reads are limited to .php, .css, .js, and .ctp extensions; MySQL and PostgreSQL deployments may expose database credentials from config/install.php, while SQLite configs expose an empty password.

## Affected products

- baserproject baserCMS 5.0.0 before 5.3.2, 5.4.0 before 5.4.2

## Timeline

- 2026-10-23: disclosed
- 2026-10-22: patched

## References

- [https://github.com/baserproject/basercms/commit/53ecf177dfb10eb1fb89c4b42d313983329aa162](https://github.com/baserproject/basercms/commit/53ecf177dfb10eb1fb89c4b42d313983329aa162)
- [https://github.com/baserproject/basercms/commit/9bc50d7a47cd834dad5ed80ad7a2e9fcb63f1321](https://github.com/baserproject/basercms/commit/9bc50d7a47cd834dad5ed80ad7a2e9fcb63f1321)

## Related threats

- [baserCMS email field address validation bypass](https://junglewise.ai/threats/cve-2026-115479-basercms-is-a-website-development-framework-in-versions-5-2-5)
- [baserCMS object injection in widget deserialization](https://junglewise.ai/threats/cve-2026-114624-basercms-is-a-website-development-framework-in-versions-5-0-0)
- [baserCMS BcThemeFile plugin path traversal in API](https://junglewise.ai/threats/cve-2026-114622-basercms-is-a-website-development-framework-in-versions-5-2-3)
- [baserCMS SQL injection in admin panel](https://junglewise.ai/threats/cve-2026-114621-basercms-is-a-website-development-framework-in-versions-5-0-0)