GHSA-673x-f5wx-fxpw
GitHub Security Advisory
Cross Site Scripting and RCE in baserCMS
✓ GitHub Reviewed
LOW
Has CVE
Advisory Details
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).
* Impact: XSS to RCE via Arbitrary file upload.
* Attack vector is: Administrator must be logged in.
* Components are: ThemeFilesController.php, UploaderFilesController.php.
* Tested baserCMS Version : 4.3.6 (Latest)
* Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
* Patches : https://basercms.net/security/20200827
Found by Vulnerability Research team in [Flatt Security Inc.](https://flatt.tech/)
Affected Packages
Packagist
baserproject/basercms
Affected versions:
4.0.0
(fixed in 4.3.7)
Related CVEs
Key Information
2.5
/10
Dataset
Last updated: July 12, 2025 6:29 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.