CVE-2026-114624 baserproject CVE debrief

Who should care

Administrators and users with widget-write capability in baserCMS installations should verify exposure and assess the integrity of their widget-area entities. This is particularly important for those who manage or interact with the affected versions of baserCMS (5.0.0 before 5.3.2 and 5.4.0 before 5.4.2), as they are at risk of potential command execution as the web-server user. Verifying exposure and assessing the integrity of widget-area entities can

Why it matters

Defenders should prioritize verifying exposure in baserCMS installations, especially for administrators and users with widget-write capability, and assess the integrity of their widget-area entities to prevent potential command execution as the web-server user.

• Potential command execution as the web-server user
• Unauthenticated page requests can trigger the object graph
• Privilege escalation for attackers with widget-write capability
• Possible lateral movement within the affected system

Technical summary

The baserCMS PHP object injection vulnerability CVE-2026-114624 allows an administrator or an attacker with widget-write capability to plant an object graph that can be triggered on unauthenticated page requests, potentially leading to command execution as the web-server user. This occurs because the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. Two demonstrated gadget chains in the default

Defensive priority

Defenders should prioritize verifying exposure in baserCMS installations, especially for administrators and users with widget-write capability, and assess the integrity of their widget-area entities.

Recommended defensive actions

• Verify the integrity of widget-area entities in baserCMS installations
• Assess exposure for administrators and users with widget-write capability
• Update baserCMS to version 5.3.2 or 5.4.2, or apply patches
• Monitor for suspicious activity on unauthenticated page requests
• Implement additional security measures to restrict widget-write capability

Evidence notes

The CVE record and source item provide details on the PHP object injection vulnerability in baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, allowing an administrator or an attacker with widget-write capability to plant an object graph that can be triggered on unauthenticated page requests, potentially leading to command execution as the web-server user.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.