https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T07:57:44.322091+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-278366 EUVD-2026-278366 2026-10-07T07:57:44.367033+00:00 EUVD-2026-278366 https://cve.radiocsirt.org/vuln/fkie_cve-2025-32957 fkie_cve-2025-32957 2026-10-07T07:57:44.367069+00:00

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.

 https://cve.radiocsirt.org/vuln/ghsa-hv78-cwp4-8r7r GHSA-hv78-cwp4-8r7r — baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE) 2026-10-07T07:57:44.367102+00:00

Affected: Packagist: baserproject/basercms

### Details The application's restore function allows users to upload a `.zip` file, which is then automatically extracted. A PHP file inside the archive is included using `require_once` without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included.

Vector: Malicious ZIP upload + insecure `require_once`

### PoC 1. Restore backup ![image](https://github.com/user-attachments/assets/9e59768a-4a8e-472d-aaef-5d54546080f6) 1. Load file shell (insecure `require_once`) ![image](https://github.com/user-attachments/assets/8f7919a2-c7f3-4ae1-af6c-1b0057e4ba22) ![image](https://github.com/user-attachments/assets/c10ef049-459d-429e-a608-8fb220c3387f)

### Impact Remote Code Execution (RCE)