CVE-2026-97150

HIGH CVSS 7.2 View on NVD ↗

Description

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://basercms.net/security/JVN_21754394
https://github.com/baserproject/BcAddonMigrator/commit/e836bc875e26910e1b5862f96cf280b4f064c104
https://jvn.jp/en/jp/JVN21754394

Published: Sep 30, 2026 08:16 UTC Modified: Sep 30, 2026 16:47 UTC