Open-source package vulnerability · Composer (PHP)

CVE-2026-30880: baserCMS has OS command injection vulnerability in installer

criticalCVSS 4.0 9.2GHSA-6hpg-8rx3-cwgv

baserCMS has an OS command injection vulnerability in the installer. Target baserCMS 5.2.2 and earlier versions Vulnerability If baserCMS is placed on a server but not installed, malicious commands may be executed. Countermeasures Update to the latest version of baserCMS Please refer to the following page to reference for more information. https://basercms.net/security/JVN54513170 Credits REN XINGDIAN

Published Mar 31, 2026

Affected packages

baserproject/basercms

Ecosystem: Composer (PHP)
Affected: <= 5.2.2
Fixed in: 5.2.3
Check: composer show baserproject/basercms

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

baserCMS has an OS command injection vulnerability in the installer.

Target

baserCMS 5.2.2 and earlier versions

Vulnerability

If baserCMS is placed on a server but not installed, malicious commands may be executed.

Countermeasures

Update to the latest version of baserCMS

Please refer to the following page to reference for more information. https://basercms.net/security/JVN_54513170

Credits

REN XINGDIAN

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries