Is CVE-2026-115479 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115479 being exploited in the wild.

How severe is CVE-2026-115479?

Medium severity, with a CVSS score of 5.3, published 23 October 2026.

Which products and versions are affected?

Baserproject baserCMS 5.2.5–5.3.1, 5.4.0–5.4.1.

Is there a fix for CVE-2026-115479?

Yes: fixed in baserCMS 5.3.2, 5.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115479 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-115479?

Check whether you run Baserproject baserCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115479: baserCMS email field address validation bypass

CVE-2026-115479 · Severity: medium · CVSS 5.3 · Published 2026-10-23

baserCMS is a website content management system that includes a mail form feature allowing visitor contact. An unauthenticated attacker can bypass email validation in form fields by supplying comma-separated email addresses, causing auto-reply messages to be sent to multiple unintended recipients using the site's identity. This enables abuse of the site's email infrastructure for unsolicited mail campaigns to third parties.

Technologies: Baserproject baserCMS. Vendors: Baserproject.

Quick answers

Is CVE-2026-115479 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115479 being exploited in the wild.
How severe is CVE-2026-115479?: Medium severity, with a CVSS score of 5.3, published 23 October 2026.
Which products and versions are affected?: Baserproject baserCMS 5.2.5–5.3.1, 5.4.0–5.4.1.
Is there a fix for CVE-2026-115479?: Yes: fixed in baserCMS 5.3.2, 5.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115479 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-115479?: Check whether you run Baserproject baserCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: baserCMS 5.3.2, 5.4.2

Technical details

The vulnerability exists in MailMessageMailer::sendFormToUser() which parses email field input via explode(',') without proper validation, sending auto-replies to all resulting addresses. The issue affects forms with email-type fields when the optional VALID_EMAIL server-side validation is not enabled; browser-level type=email validation is bypassed by crafted POST requests. The bundled contact form includes VALID_EMAIL and is unaffected; the fix enforces mandatory email format validation on email-type fields regardless of configuration.

Affected products

baserproject baserCMS 5.2.5–5.3.1, 5.4.0–5.4.1

Timeline

2026-10-23: disclosed: CVE-2026-115479 published
2026-10-22: patched: Fix committed to 5.3.x and 5.4.x branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.