A critical vulnerability in baserCMS allows authenticated attackers to achieve remote code execution via insecure file upload and extraction.

This vulnerability is an unrestricted file upload flaw (CWE-434) where the application fails to validate the contents of uploaded ZIP archives. An authenticated user with administrative privileges can upload a crafted archive containing a PHP file, which is subsequently included and executed by the server.

The ability to execute arbitrary code on a web server poses a severe threat to business operations, as it grants an attacker full control over the application environment. This can lead to total compromise of web application data, unauthorized access to internal systems, and potential lateral movement within the network. Given the CVSS score of 8.7, this vulnerability represents a high-severity risk that requires immediate attention to prevent system takeover.

Immediate Action: Update the baserCMS installation to version 5.2.3 or later, which includes the necessary validation logic to prevent the execution of malicious files.

Proactive Monitoring: Review web server access logs for unusual requests directed at the restore functionality or unexpected PHP file inclusions following administrative operations.

Compensating Controls: Implement strict file upload policies and utilize a Web Application Firewall to inspect ZIP archives for malicious payloads before they reach the application server.

Public Exploit Available: No (no confirmed public exploit identified).

Security teams should prioritize updating to baserCMS version 5.2.3 immediately to neutralize this remote code execution vector. Given that the vulnerability requires administrative privileges, ensure that access to administrative interfaces is strictly limited to authorized personnel to reduce the attack surface until the patch is applied.