PatchSiren cyber security CVE debrief
CVE-2026-76635 baserproject CVE debrief
The CVE-2026-76635 vulnerability is a SQL injection flaw in baserCMS before version 5.3.0, located in BcDatabaseService.php. Authenticated administrators can exploit this vulnerability to inject malicious SQL table names and configuration values. A backup restore code injection flaw exists, allowing attackers to plant malicious table names and trigger error-based SQL injection to retrieve database information. This vulnerability has a high impact on affected systems, and administrators should take immediate action to update their installations. The CVE record was published on 2026-08-20T14:17:59.973Z and has not been modified since then. To verify the vulnerability, review the official CVE Program record and NIST NVD detail page for source-provided CVE metadata and vulnerability assessment.
- Vendor
- baserproject
- Product
- basercms
- CVSS
- HIGH 8.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-20
- Original CVE updated
- 2026-08-25
- Advisory published
- 2026-08-20
- Advisory updated
- 2026-08-25
Who should care
Authenticated administrators of baserCMS versions prior to 5.3.0 should be aware of this vulnerability and take immediate action to update their installations. This involves reviewing the official advisory, planning vendor-supported updates or mitigations, and implementing compensating controls for exposed systems. Additionally, affected operators, platforms, vulnerability-management teams, and security teams should be informed of the potential impact and review context to ensure proper mitigation and remediation.
Technical summary
The CVE-2026-76635 vulnerability is a SQL injection flaw in baserCMS before version 5.3.0, located in BcDatabaseService.php. Authenticated administrators can exploit this vulnerability to inject malicious SQL table names and configuration values. Additionally, a backup restore code injection flaw exists, allowing attackers to plant malicious table names and trigger error-based SQL injection to retrieve database information.
Defensive priority
Authenticated administrators should urgently update baserCMS to version 5.3.0 or later to prevent SQL injection attacks.
Recommended defensive actions
- Update baserCMS to version 5.3.0 or later immediately.
- Restrict access to BcDatabaseService.php to only trusted administrators.
- Monitor for suspicious SQL queries and database access patterns.
- Implement additional security controls, such as web application firewalls and intrusion detection systems.
- Conduct regular security audits and vulnerability assessments.
Evidence notes
The CVE-2026-76635 record indicates a SQL injection vulnerability in baserCMS before version 5.3.0, specifically in BcDatabaseService.php. Authenticated administrators are at risk as they can inject malicious table names and configuration values into SQL statements. A backup restore code injection flaw exists, allowing attackers to plant malicious table names and trigger error-based SQL injection to retrieve database information.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-76635 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-76635
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-76635 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76635
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/baserproject/basercms/releases/tag/5.3.0
-
Source reference
Unverified legacy reference
URL: https://github.com/baserproject/basercms/security/advisories/GHSA-cg65-f2m7-9fqj
-
Source reference
Unverified legacy reference
URL: https://www.vulncheck.com/advisories/basercms-sql-injection-and-code-injection-via-bcdatabaseservice-php
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.