CVE-2026-114623

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containing literal ../ segments, and the view and edit actions pass it to ThemeFilesService::get() without containment validation. Authorization checks the unresolved request path, after which ThemeFile::_getContents() reads the resolved file and exposes its contents in the form textarea. A client must preserve the dot segments rather than normalize them away. Readable files are limited to .php, .css, .js, and .ctp; this can disclose application source and config/install.php database credentials in MySQL or PostgreSQL deployments, while SQLite configurations have an empty database password. Reading config/app_local.php may expose the Security.salt fallback, which is effective only when not overridden by environment configuration. The flaw does not disclose .env, .pem, or SQLite .db files, does not itself permit file writes or code execution, and does not affect the separate API getFullpath() route. The plugin is disabled by default and unauthenticated requests are not sufficient. This issue has been patched in versions 5.3.2 and 5.4.2.

• CWE-22
• CWE-200
• CWE-863

• https://github.com/baserproject/basercms/commit/53ecf177dfb10eb1fb89c4b42d313983329aa162
• https://github.com/baserproject/basercms/commit/9bc50d7a47cd834dad5ed80ad7a2e9fcb63f1321
• https://github.com/baserproject/basercms/releases/tag/5.3.2
• https://github.com/baserproject/basercms/releases/tag/5.4.2
• https://github.com/baserproject/basercms/security/advisories/GHSA-rqr8-gmx5-xvrr

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114618Authlib is a Python library which builds OAuth and OpenID Co…6.8
• CVE-2026-114619Authlib is a Python library which builds OAuth and OpenID Co…4.6
• CVE-2026-11462A vulnerability was found in Chengdu Everbrite Network Techn…7.3
• CVE-2026-114620Authlib is a Python library which builds OAuth and OpenID Co…5.4
• CVE-2026-114621baserCMS is a website development framework. In versions 5.0…8.8
• CVE-2026-114622baserCMS is a website development framework. In versions 5.2…7.2
• CVE-2026-114624baserCMS is a website development framework. In versions 5.0…7.2
• CVE-2026-114625VeloCloud Orchestrator (VCO) on-prem has a security issue wh…9.9
• CVE-2026-114627Web::Simple versions before 0.036 for Perl do not escape val…
• CVE-2026-114629Web::Simple versions before 0.035 for Perl allocate a buffer…7.5
• CVE-2026-11463A vulnerability was determined in USCiLab Cereal up to 1.3.2…7.3
• CVE-2026-114630The ELEX WordPress HelpDesk & Customer Ticketing System plug…9.1