CVE-2025-32957

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.

• CWE-434

• https://basercms.net/security/JVN_20837860Vendor Advisory
• https://github.com/baserproject/basercms/releases/tag/5.2.3Release Notes
• https://github.com/baserproject/basercms/security/advisories/GHSA-hv78-cwp4-8r7rExploit, Vendor Advisory
• https://github.com/baserproject/basercms/security/advisories/GHSA-hv78-cwp4-8r7rExploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32950Jmix is a set of libraries and tools to speed up Spring Boot…6.5
• CVE-2025-32951Jmix is a set of libraries and tools to speed up Spring Boot…5.4
• CVE-2025-32952Jmix is a set of libraries and tools to speed up Spring Boot…6.5
• CVE-2025-32953z80pack is a mature emulator of multiple platforms with 8080…8.7
• CVE-2025-32955Harden-Runner is a CI/CD security agent that works like an E…6
• CVE-2025-32956ManageWiki is a MediaWiki extension allowing users to manage…8
• CVE-2025-32958Adept is a language for general purpose programming. Prior t…9.8
• CVE-2025-32959CUBA Platform is a high level framework for enterprise appli…6.5
• CVE-2025-3296A vulnerability, which was classified as critical, has been …6.3
• CVE-2025-32960The CUBA REST API add-on performs operations on data and ent…6.4
• CVE-2025-32961The Cuba JPA web API enables loading and saving any entities…6.4
• CVE-2025-32962Flask-AppBuilder is an application development framework bui…6.1