Executive brief
BaserCMS is a content management system used to build and manage websites. This vulnerability allows attackers to inject malicious formulas into CSV export files. When a user downloads and opens an affected CSV file in a spreadsheet application, the injected code can be executed, potentially compromising the user's system or stealing sensitive data.
Technical details
BaserCMS fails to properly neutralize formula elements when generating CSV files, allowing CSV injection (also known as formula injection). An attacker with the ability to influence data exported as CSV (via administrative features or data entry points) can inject formulas starting with characters like =, +, @, or - that are interpreted as commands by spreadsheet applications. The vulnerability requires user interaction—specifically, the victim must download and open the malicious CSV file in an application like Excel or Calc. No authentication bypass is required if the CSV export feature is accessible to unauthenticated users. Successful exploitation can result in arbitrary code execution on the user's system. The vulnerability affects BaserCMS versions 5.0.0 through 5.2.8; users should upgrade to version 5.3.0 or later.
Affected products
- baserCMS Users Community BaserCMS 5.0.0 to 5.2.8
Timeline
- 2026-07-30: disclosed
- 2026-07-31: advisory
- 2026-08-03: other: Published to NVD