CVE-2026-97150: baserCMS Addon Migrator RCE Vulnerability

CVE-2026-97150 Overview

CVE-2026-97150 is an authenticated remote code execution vulnerability in the baserCMS BcAddonMigrator component. When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes config.php from the uploaded addon. Any PHP code contained in that file executes during the migration process. An administrative user can leverage this behavior to read or delete arbitrary files on the underlying system, and to run arbitrary PHP code in the web server context. The issue is tracked under advisory JVN#21754394 and GHSA-jq83-g24q-wph5, and is classified as [CWE-829] Inclusion of Functionality from Untrusted Control Sphere.

Critical Impact

An authenticated administrator can upload a crafted addon whose config.php executes attacker-controlled PHP, resulting in arbitrary file read, file deletion, and code execution on the baserCMS host.

Affected Products

• baserCMS BcAddonMigrator component (baserproject/BcAddonMigrator)
• baserCMS installations that use BcAddonMigrator to convert baserCMS4-style addons to baserCMS5-style addons
• Versions prior to the fix in commit e836bc875e26910e1b5862f96cf280b4f064c104

Discovery Timeline

• 2026-09-30 - CVE-2026-97150 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-97150

Vulnerability Analysis

The BcAddonMigrator5Component in baserCMS reads addon metadata by directly executing the addon's config.php via a PHP include statement. In legacy baserCMS4 addons, config.php was expected to define variables such as $title, $description, $author, $url, $adminLink, and $installMessage. Because include treats the file as PHP source, any statements in that file run with the privileges of the web server process. An administrator who uploads an addon controls the contents of config.php, so the migrator effectively evaluates attacker-supplied PHP during the conversion workflow.

Root Cause

The root cause is unsafe consumption of untrusted input as executable code, mapped to [CWE-829]. The migrator conflated "read configuration values" with "execute a PHP file," giving the addon package full control over the interpreter. There is no sandbox, no allow-list of expected symbols, and no static parsing of the file before execution.

Attack Vector

Exploitation requires authenticated access with administrative privileges. The attacker packages a malicious baserCMS4-style addon that contains a config.php file with arbitrary PHP payloads, then invokes the addon migration feature. During conversion, the PHP payload executes in the web application context, allowing arbitrary file reads, file deletions, and further command execution reachable from PHP.

// Patch excerpt: src/Controller/Component/BcAddonMigrator5Component.php
// Vulnerable behavior (removed):
-			$config = include $path;
-			if(is_array($config)) return;
-			if(!isset($title)) $title = $plugin;
-			if(!isset($description)) $description = '';
-			if(!isset($author)) $author = '';
-			if(!isset($url)) $url = '';
-			if(!isset($adminLink)) $adminLink = [];
-			if(!isset($installMessage)) $installMessage = '';

// Fixed behavior: parse config.php statically instead of executing it
+			$parsed = \BcAddonMigrator\Utility\AddonConfigParser::parse(
+				(string)file_get_contents($path)
+			);
+			if($parsed['isReturnArray']) return;
+			$vars = $parsed['vars'];
+			$title          = $vars['title']          ?? $plugin;
+			$description    = $vars['description']    ?? '';
+			$author         = $vars['author']         ?? '';
+			$url            = $vars['url']            ?? '';
+			$adminLink      = $vars['adminLink']      ?? [];
+			$installMessage = $vars['installMessage'] ?? '';

Source: GitHub commit e836bc8

Detection Methods for CVE-2026-97150

Indicators of Compromise

• Unexpected addon upload events in baserCMS admin logs referencing the addon migration workflow.
• Presence of unfamiliar addon directories containing a config.php that includes function calls such as file_get_contents, unlink, system, exec, passthru, eval, or base64_decode.
• Web server or PHP-FPM processes spawning shell commands or touching sensitive files (for example /etc/passwd, application secrets) shortly after an addon migration request.
• Unexpected file deletions or new PHP web shells inside the baserCMS web root following administrative activity.

Detection Strategies

• Review HTTP access logs for POST requests to baserCMS admin endpoints that invoke BcAddonMigrator conversion actions, correlated with the uploading administrator account.
• Perform static scanning of any config.php under addon directories for PHP constructs beyond simple variable assignments; the legitimate file only assigns $title, $description, $author, $url, $adminLink, and $installMessage.
• Monitor process creation from the web server user for interpreters or shell utilities that should not normally originate from PHP.

Monitoring Recommendations

• Alert on administrative logins from new source IPs or user agents, since exploitation requires an authenticated admin session.
• Enable file integrity monitoring on the baserCMS plugin and webroot directories to detect newly written or modified PHP files.
• Forward baserCMS application logs and web server logs to a central analytics platform and retain them for post-incident review.

How to Mitigate CVE-2026-97150

Immediate Actions Required

• Update baserproject/BcAddonMigrator to a version that includes commit e836bc875e26910e1b5862f96cf280b4f064c104, which replaces include with static parsing via AddonConfigParser.
• Restrict administrative accounts to trusted personnel and enforce multi-factor authentication on baserCMS admin logins.
• Audit installed addons and remove any that were not sourced from a trusted publisher, particularly those uploaded during unexplained admin sessions.

Patch Information

The upstream fix is published in the BcAddonMigrator GitHub commit. The patch stops including config.php and instead parses it with \BcAddonMigrator\Utility\AddonConfigParser::parse() using token_get_all, extracting only expected configuration values. Additional detail is available in the BaserCMS Security Advisory and the JVN#21754394 reference.

Workarounds

• Disable the addon migration feature until the patched version is deployed if administrators cannot upgrade immediately.
• Block uploads of baserCMS4-style addons at the reverse proxy or WAF layer, or restrict the migration endpoint to a maintenance IP allow-list.
• Run the baserCMS PHP process as a low-privilege user with restricted filesystem permissions to reduce the blast radius of arbitrary file read or deletion.

# Example: pin the patched BcAddonMigrator revision with Composer
composer require baserproject/bc-addon-migrator:dev-main#e836bc875e26910e1b5862f96cf280b4f064c104

# Optional: temporarily deny access to the migration controller at the web server
# (nginx example)
location ~* /baser/admin/bc-addon-migrator/ {
    deny all;
    return 403;
}