CVE-2026-21861

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.

• CWE-78

• https://basercms.net/security/JVN_20837860Vendor Advisory
• https://github.com/baserproject/basercms/releases/tag/5.2.3Release Notes
• https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86gExploit, Vendor Advisory
• https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86gExploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21856The Tarkov Data Manager is a tool to manage the Tarkov item …8.8
• CVE-2026-21857REDAXO is a PHP-based content management system. Prior to ve…6.5
• CVE-2026-21858n8n is an open source workflow automation platform. Versions…10
• CVE-2026-21859Mailpit is an email testing tool and API for developers. Ver…5.3
• CVE-2026-2186A vulnerability has been found in Tenda RX3 16.03.13.11. Imp…8.8
• CVE-2026-21860Werkzeug is a comprehensive WSGI web application library. Pr…5.3
• CVE-2026-21862RustFS is a distributed object storage system built in Rust.…7.5
• CVE-2026-21863Valkey is a distributed key-value database. Prior to version…7.5
• CVE-2026-21864Valkey-Bloom is a Rust based Valkey module which brings a Bl…7.5
• CVE-2026-21865Discourse is an open source discussion platform. In versions…6.5
• CVE-2026-21866Dify is an open-source LLM app development platform. Prior t…5.4
• CVE-2026-21867Rejected reason: Reason: This candidate was issued in error.