baserCMS BcCustomContent: Arbitrary PHP file upload and execution
Summary
baserCMS, a website development framework, has a flaw in the BcCustomContent plugin that allows arbitrary PHP code to be stored and executed under the document root. According to the CVE description, PermissionGroupsService::build() adds a wildcard allow rule for all non-admin groups when a plugin has no config/permission.php, and BcCustomContent has no such file. The CNA record instead describes file fields that can be configured to allow executable extensions such as php. An attacker with a low-privilege operator account, after an administrator has installed the plugin, could upload and run a web shell.
Affected
- baserCMS 5.0.0-beta1 to before 5.3.2
- baserCMS 5.4.0 to before 5.4.2
- Component: BcCustomContent plugin
Fixed in
- Upgrade to baserCMS 5.3.2 or 5.4.2 (or later).
Workaround
- No vendor workaround published.
- Review operator group permissions in the admin panel and remove access that is not needed.
- Check the BcCustomContent file-field settings and remove executable extensions from the allowed list.
- Check the web root for unexpected PHP files.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found.
- Not in CISA KEV at the time of research.
Our recommendation
- Update baserCMS to 5.3.2 or 5.4.2 (or later) as a priority if the site is internet-facing or has several operator accounts.
- If you cannot update immediately, apply the workarounds above.
- Check whether BcCustomContent is installed and whether unexpected PHP files exist in the web root.
- Restrict admin panel access by network and review operator accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8jrp-4h7c-m679 github.com
- baserCMS release 5.3.2 github.com
- baserCMS release 5.4.2 github.com
- Fix commit 2ed19c8 github.com
- Fix commit b0ef31b github.com
- VulDB CVE-2026-115481 vuldb.com
- OSV CVE-2026-115481 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:13.
Original description (NVD)
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.
NVD references (5)
- https://github.com/baserproject/basercms/commit/2ed19c878add5c26fc765572e0e77173c1f1fdb5
- https://github.com/baserproject/basercms/commit/b0ef31b10dc6267b48ebc9a80d34bc7c4c09c311
- https://github.com/baserproject/basercms/releases/tag/5.3.2
- https://github.com/baserproject/basercms/releases/tag/5.4.2
- https://github.com/baserproject/basercms/security/advisories/GHSA-8jrp-4h7c-m679
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.