CVE-2026-115481 baserproject CVE debrief

Who should care

Defenders managing baserCMS installations, especially those with the BcCustomContent plugin, should assess exposure and prioritize patching or restricting file uploads to mitigate potential risks.

Why it matters

CVE-2026-115481 allows for arbitrary PHP file uploads in baserCMS with the BcCustomContent plugin, impacting versions 5.0.0-beta1 up to but not including 5.3.2 and 5.4.2. Defenders should verify exposure, restrict file uploads, and prioritize patching to mitigate risks.

• Potential for arbitrary PHP execution under the document root
• Risk of unauthorized file uploads and execution
• Need for verification of baserCMS and BcCustomContent plugin versions
• Priority for patching or applying compensating controls

Technical summary

The baserCMS BcCustomContent plugin allows file fields to be configured with executable file extensions like PHP, enabling arbitrary PHP file uploads. This issue arises from a missing permission configuration file for the plugin, leading to a wildcard allow rule for non-admin groups. Affected product deployments should be verified, and defenders should prioritize patching or restricting file uploads to mitigate potential risks. The vulnerability impacts versions 5.0.0-beta1 up to but not including 5.3.2 and 5.4.2, and the default 'operators' group can store and execute arbitrary PHP under the document root if the BcCustomContent plugin is installed.

Defensive priority

Defenders should prioritize verifying exposure of baserCMS installations with the BcCustomContent plugin installed, especially those with version 5.0.0-beta1 up to but not including 5.3.2 or 5.4.2, and restrict file uploads to only allow intended file types.

Recommended defensive actions

• Verify baserCMS version and BcCustomContent plugin installation
• Restrict file uploads to intended file types
• Monitor for suspicious file uploads and PHP execution
• Apply patches from versions 5.3.2 or 5.4.2
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item detail provide information on the vulnerability, affected versions, and patches. However, specific details about exploitation or victim impact are not provided, suggesting a need for verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.