CVE-2025-32957

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
baserproject	basercms	< 5.2.3

References

https://basercms.net/security/JVN_20837860Vendor Advisory
https://github.com/baserproject/basercms/releases/tag/5.2.3Release Notes
https://github.com/baserproject/basercms/security/advisories/GHSA-hv78-cwp4-8r7rExploit, Vendor Advisory
https://github.com/baserproject/basercms/security/advisories/GHSA-hv78-cwp4-8r7rExploit, Vendor Advisory

Timeline

Published: Mar 31, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-329589.8Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact CVE-2025-329596.5CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementat CVE-2025-32966.3A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown CVE-2025-329606.4The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file pat CVE-2025-329616.4The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests. Prior to CVE-2025-329626.1Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthen CVE-2025-329636.9MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audienc CVE-2025-329644.6ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 00bebea, when enabling a conflicting extension, a restri CVE-2025-329659.3xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2 CVE-2025-329669.8DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend CVE-2025-329675.4OpenEMR is a free and open source electronic health records and medical practice management application. A logging oversight in versions pri CVE-2025-329688.8XWiki is a generic wiki platform. In versions starting from 1.6-milestone-1 to before 15.10.16, 16.4.6, and 16.10.1, it is possible for a us