# CVE-2026-76635: baserCMS SQL injection in BcDatabaseService

Source: https://junglewise.ai/threats/cve-2026-76635-basercms-sql-injection-in-bcdatabaseservice  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76635 · Severity: high · CVSS 7.2 · Published 2026-08-20

baserCMS is a Japanese open-source content management system used to build and manage websites. The vulnerability allows authenticated administrators to inject malicious SQL code into database operations through unvalidated table names and configuration values, potentially exposing sensitive database contents, credentials, and user data. Additionally, a flaw in backup restoration validation permits execution of arbitrary PHP code to set up these injections.

## Quick answers

**Is CVE-2026-76635 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76635 being exploited in the wild.

**How severe is CVE-2026-76635?** High severity, with a CVSS score of 7.2, published 20 August 2026.

**Which products and versions are affected?** baserproject baserCMS before 5.2.10, before 5.3.0.

**Is there a fix for CVE-2026-76635?** A patch was published on 2026-07-30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76635 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76635?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability consists of two chained flaws in BcDatabaseService.php: (1) six raw SQL interpolation points that accept unsanitized table names and schema configuration values directly in SQL statements used during sequence updates, CSV exports, and table management; and (2) a schema file validation bypass (CWE-94) where PHP code outside class definitions in backup schema files executes unconditionally upon loading. An authenticated administrator can download a backup, inject malicious PHP into the schema file to create a table with a SQL injection payload as its name, upload the modified backup to trigger restoration, and then invoke updateSequence() to trigger error-based SQL injection that exfiltrates database metadata and version information from PostgreSQL. The attack requires administrative access but no patch is required beyond upgrading; version 5.2.10 and 5.3.0+ contain fixes using parameterized queries and AST-based code validation.

## Affected products

- baserproject baserCMS before 5.2.10, before 5.3.0

## Timeline

- 2026-07-30: disclosed
- 2026-07-30: patched

## References

- [https://github.com/baserproject/basercms/releases/tag/5.3.0](https://github.com/baserproject/basercms/releases/tag/5.3.0)
- [https://github.com/baserproject/basercms/security/advisories/GHSA-cg65-f2m7-9fqj](https://github.com/baserproject/basercms/security/advisories/GHSA-cg65-f2m7-9fqj)