CVE-2026-30940: Basercms Path Traversal Vulnerability

CVE-2026-30940 Overview

CVE-2026-30940 is a path traversal vulnerability affecting baserCMS, a popular website development framework. The vulnerability exists in the theme file management API endpoint (/baser/api/admin/bc-theme-file/theme_files/add.json) which allows authenticated administrators to write arbitrary files to locations outside the intended theme directory. By including ../ sequences in the path parameter, an attacker can create PHP files in arbitrary directories, potentially resulting in remote code execution (RCE).

Critical Impact

Authenticated administrators can exploit this path traversal vulnerability to achieve remote code execution by writing malicious PHP files to arbitrary locations on the web server.

Affected Products

• baserCMS versions prior to 5.2.3
• baserCMS theme file management API component
• Web servers running vulnerable baserCMS installations

Discovery Timeline

• 2026-03-31 - CVE-2026-30940 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-30940

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal) and enables authenticated administrators to break out of the intended theme directory structure. The theme file management API fails to properly sanitize user-supplied path parameters before using them in file write operations. When a user submits a request to create a new theme file, the API accepts a path parameter that should designate a location within the theme directory. However, insufficient validation allows directory traversal sequences to redirect file writes to arbitrary locations on the filesystem.

The exploitation requires administrative authentication, which limits the attack surface but does not eliminate the risk. Compromised admin accounts, insider threats, or privilege escalation from lower-privileged users could all lead to exploitation. Once exploited, an attacker can write a PHP web shell to a publicly accessible directory, achieving full remote code execution with the privileges of the web server process.

Root Cause

The root cause is improper input validation in the theme file management API. The application does not adequately sanitize or normalize the path parameter before concatenating it with the base theme directory path. This allows sequences like ../ to escape the intended directory boundary and traverse to parent directories or other locations on the filesystem.

Attack Vector

The attack is network-based and requires authentication with administrative privileges. An attacker would craft a malicious API request to the /baser/api/admin/bc-theme-file/theme_files/add.json endpoint, including path traversal sequences in the path parameter. The payload would typically contain PHP code designed to execute system commands or provide backdoor access.

The vulnerability can be exploited by sending a crafted POST request to the theme file management API endpoint. The attacker includes ../ sequences in the path parameter to escape the theme directory, specifying a target location such as the web root, and providing malicious PHP code as the file content. Upon successful exploitation, the attacker can then access the uploaded PHP file via HTTP to execute arbitrary commands on the server. For detailed technical information, refer to the GitHub Security Advisory GHSA-c5c6-37vq-pjcq.

Detection Methods for CVE-2026-30940

Indicators of Compromise

• Unexpected PHP files created outside the theme directory structure, particularly in the web root or other publicly accessible directories
• Web server access logs showing POST requests to /baser/api/admin/bc-theme-file/theme_files/add.json with unusual path parameters containing ../ sequences
• Newly created files with suspicious content patterns such as eval(), base64_decode(), system(), or exec() function calls
• Authentication logs showing admin account activity from unusual IP addresses or at unexpected times

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing path traversal patterns (../, ..%2f, ..%5c) in API parameters
• Monitor file integrity for the baserCMS installation directories, alerting on unexpected file creations outside designated areas
• Review web server access logs for suspicious API calls targeting the theme file management endpoint with encoded or plaintext traversal sequences
• Deploy endpoint detection solutions that can identify web shell artifacts and suspicious PHP file executions

Monitoring Recommendations

• Enable detailed logging for all admin API endpoints in baserCMS and forward logs to a centralized SIEM for analysis
• Configure file integrity monitoring (FIM) on web server directories to detect unauthorized file creation or modification
• Implement alerting for admin authentication events, especially from new IP addresses or geographic locations
• Monitor process execution on web servers for unusual child processes spawned by the PHP interpreter

How to Mitigate CVE-2026-30940

Immediate Actions Required

• Upgrade baserCMS to version 5.2.3 or later immediately to patch this vulnerability
• Audit admin account access and review recent API activity for signs of exploitation
• Scan the filesystem for unexpected PHP files, particularly outside the theme directories
• Review and restrict admin account privileges following the principle of least privilege

Patch Information

The vulnerability has been patched in baserCMS version 5.2.3. The patch implements proper input validation and path canonicalization for the theme file management API, preventing directory traversal attacks. Administrators should upgrade immediately by downloading the latest release from the GitHub Release v5.2.3. Additional details are available in the BaserCMS Security Advisory JVN_20837860.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the theme file management API by restricting access at the web server level
• Implement WAF rules to block requests containing path traversal sequences targeting the vulnerable endpoint
• Restrict admin panel access to trusted IP addresses only using firewall rules or web server configuration
• Enable additional authentication factors for admin accounts to reduce the risk of credential compromise

For environments where upgrading is not immediately feasible, access to the vulnerable API endpoint can be restricted at the web server level. In Apache, add a directive to deny access to the theme files API endpoint and restrict admin access to specific IP ranges. Similar restrictions can be implemented in Nginx by using location blocks to return 403 for the vulnerable endpoint or limit access to allowed IP addresses. These are temporary measures and should not replace upgrading to the patched version.