CVE-2026-97150

HIGHCVSS 7.2

Description

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

Timeline

Published:September 30th, 2026 8:16 AM

Last modified:September 30th, 2026 4:47 PM

CVSS Scoring

CVSS v3: 7.2 (HIGH)

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-829

References & Reports

Advisories, patches, and third-party reports

https://basercms.net/security/JVN_21754394
https://github.com/baserproject/BcAddonMigrator/commit/e836bc875e26910e1b5862f96cf280b4f064c104
https://jvn.jp/en/jp/JVN21754394

Source: NIST NVD · Data may lag official sources by up to one minute