CVE-2026-30940: Basercms Path Traversal Vulnerability

CVE-2026-30940 Overview

CVE-2026-30940 is a path traversal vulnerability affecting baserCMS, a popular website development framework. The vulnerability exists in the theme file management API endpoint (/baser/api/admin/bc-theme-file/theme_files/add.json) which allows authenticated administrators to write arbitrary files to locations outside the intended theme directory. By including ../ sequences in the path parameter, an attacker can create PHP files in arbitrary directories, potentially resulting in remote code execution (RCE).

Critical Impact
Authenticated administrators can exploit this path traversal vulnerability to achieve remote code execution by writing malicious PHP files to arbitrary locations on the web server.

Affected Products

baserCMS versions prior to 5.2.3
baserCMS theme file management API component
Web servers running vulnerable baserCMS installations

Discovery Timeline

2026-03-31 - CVE-2026-30940 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-30940

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal) and enables authenticated administrators to break out of the intended theme directory structure. The theme file management API fails to properly sanitize user-supplied path parameters before using them in file write operations. When a user submits a request to create a new theme file, the API accepts a path parameter that should designate a location within the theme directory. However, insufficient validation allows directory traversal sequences to redirect file writes to arbitrary locations on the filesystem.

The exploitation requires administrative authentication, which limits the attack surface but does not eliminate the risk. Compromised admin accounts, insider threats, or privilege escalation from lower-privileged users could all lead to exploitation. Once exploited, an attacker can write a PHP web shell to a publicly accessible directory, achieving full remote code execution with the privileges of the web server process.

Root Cause

The root cause is improper input validation in the theme file management API. The application does not adequately sanitize or normalize the path parameter before concatenating it with the base theme directory path. This allows sequences like ../ to escape the intended directory boundary and traverse to parent directories or other locations on the filesystem.

Attack Vector

The attack is network-based and requires authentication with administrative privileges. An attacker would craft a malicious API request to the /baser/api/admin/bc-theme-file/theme_files/add.json endpoint, including path traversal sequences in the path parameter. The payload would typically contain PHP code designed to execute system commands or provide backdoor access.

The vulnerability can be exploited by sending a crafted POST request to the theme file management API endpoint. The attacker includes ../ sequences in the path parameter to escape the theme directory, specifying a target location such as the web root, and providing malicious PHP code as the file content. Upon successful exploitation, the attacker can then access the uploaded PHP file via HTTP to execute arbitrary commands on the server. For detailed technical information, refer to the GitHub Security Advisory GHSA-c5c6-37vq-pjcq.

Detection Methods for CVE-2026-30940

Indicators of Compromise

Unexpected PHP files created outside the theme directory structure, particularly in the web root or other publicly accessible directories
Web server access logs showing POST requests to /baser/api/admin/bc-theme-file/theme_files/add.json with unusual path parameters containing ../ sequences
Newly created files with suspicious content patterns such as eval(), base64_decode(), system(), or exec() function calls
Authentication logs showing admin account activity from unusual IP addresses or at unexpected times

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block requests containing path traversal patterns (../, ..%2f, ..%5c) in API parameters
Monitor file integrity for the baserCMS installation directories, alerting on unexpected file creations outside designated areas
Review web server access logs for suspicious API calls targeting the theme file management endpoint with encoded or plaintext traversal sequences
Deploy endpoint detection solutions that can identify web shell artifacts and suspicious PHP file executions

Monitoring Recommendations

Enable detailed logging for all admin API endpoints in baserCMS and forward logs to a centralized SIEM for analysis
Configure file integrity monitoring (FIM) on web server directories to detect unauthorized file creation or modification
Implement alerting for admin authentication events, especially from new IP addresses or geographic locations
Monitor process execution on web servers for unusual child processes spawned by the PHP interpreter

How to Mitigate CVE-2026-30940

Immediate Actions Required

Upgrade baserCMS to version 5.2.3 or later immediately to patch this vulnerability
Audit admin account access and review recent API activity for signs of exploitation
Scan the filesystem for unexpected PHP files, particularly outside the theme directories
Review and restrict admin account privileges following the principle of least privilege

Patch Information

The vulnerability has been patched in baserCMS version 5.2.3. The patch implements proper input validation and path canonicalization for the theme file management API, preventing directory traversal attacks. Administrators should upgrade immediately by downloading the latest release from the GitHub Release v5.2.3. Additional details are available in the BaserCMS Security Advisory JVN_20837860.

Workarounds

If immediate patching is not possible, consider temporarily disabling the theme file management API by restricting access at the web server level
Implement WAF rules to block requests containing path traversal sequences targeting the vulnerable endpoint
Restrict admin panel access to trusted IP addresses only using firewall rules or web server configuration
Enable additional authentication factors for admin accounts to reduce the risk of credential compromise

For environments where upgrading is not immediately feasible, access to the vulnerable API endpoint can be restricted at the web server level. In Apache, add a directive to deny access to the theme files API endpoint and restrict admin access to specific IP ranges. Similar restrictions can be implemented in Nginx by using location blocks to return 403 for the vulnerable endpoint or limit access to allowed IP addresses. These are temporary measures and should not replace upgrading to the patched version.