CVE-2026-21861

critical · 9.1

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.

9.1

CVSS

2.3%

EPSS (exploit prob.)

82nd

EPSS percentile

2026-03-31

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
basercms	basercms	< 5.2.3

Check a specific version with /api/v1/cve/match.

References

https://basercms.net/security/JVN_20837860
https://github.com/baserproject/basercms/releases/tag/5.2.3
https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g
https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-21861