Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114624— baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity

Quick assessment

Affected
baserproject basercms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

baserCMS 是一个网站开发框架。在 5.0.0 至 5.3.2（不含 5.3.2）以及 5.4.0 至 5.4.2（不含 5.4.2）的版本中，widget-area 实体仅在提交的值为数组时才对小部件（widget）进行序列化，导致通过管理端 JSON API 提交的字符串可原样存储。实体读取操作（包括前端渲染和 API 响应）在反序列化存储值时会调用 unserialize()，且未设置 allowed_classes 限制，从而接受原始序列化数据及 Base64 编码的序列化数据。 具备管理员权限的攻击

CVSS 7.2 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
baserproject basercms >= 5.0.0, < 5.3.2 affected
>= 5.4.0, < 5.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114624

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity
Source: CVE Program / CVE List V5
Vulnerability Description
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests. Two demonstrated gadget chains in the default dependency set use composer/composer ProcessExecutor::startJob() with Process::fromShellCommandline(), or logiscape/mcp-sdk-php StdioTransport::connect() with StdioServerParameters, to reach proc_open() and execute commands as the web-server user. Deserialization bypasses constructor-based readonly safeguards, and the stored payload can execute repeatedly until the database row is repaired. Unauthenticated page access is a trigger after privileged payload storage, not an unauthenticated means of initially planting the payload. This issue has been patched in versions 5.3.2 and 5.4.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
baserproject basercms >= 5.0.0, < 5.3.2 -

II. Public POCs for CVE-2026-114624

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114624

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-114624 (2)

Vendor Advisories for CVE-2026-114624 (1)

Vendor Pages for CVE-2026-114624 (1)

Same Patch Batch · baserproject · 2026-10-23 · 8 CVEs total

CVE-2026-114621 8.8 HIGH baserCMS: SQL injection in the admin panel and admin API
CVE-2026-115481 8.5 HIGH baserCMS: BcCustomContent file fields can be configured to allow executable file extension
CVE-2026-114622 7.2 HIGH baserCMS: Encoded path traversal bypass in the theme file API
CVE-2026-115457 7.1 HIGH baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments
CVE-2026-114623 6.5 MEDIUM baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure
CVE-2026-115479 5.3 MEDIUM baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients
CVE-2026-115480 5.3 MEDIUM baserCMS: Public Web API mail-form submission bypasses image CAPTCHA

IV. Related Vulnerabilities

Same product: basercms
Same vendor: baserproject
Same weakness: CWE-502

V. Comments for CVE-2026-114624

No comments yet

Leave a comment