GHSA-h4cc-fxpp-pgw9

baserCMS File Uploader Remote Code Execution (RCE) vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-25654

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	baserproject/basercms	< 4.7.5	4.7.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact There is a Remote Code Execution (RCE) Vulnerability on the management system of baserCMS. ### Target baserCMS 4.7.3 and earlier versions ### Patches Update to the latest version of baserCMS ### Credits 島峰泰平＠三井物産セキュアディレクション株式会社

References

External links from the advisory. They lead to third-party sites.

https://github.com/baserproject/basercms/security/advisories/GHSA-h4cc-fxpp-pgw9 web
https://nvd.nist.gov/vuln/detail/CVE-2023-25654 advisory
https://github.com/baserproject/basercms/commit/002886be0998c74c386e04f0b43688a8a45d7a96 web
https://github.com/baserproject/basercms/commit/08247f0a633d8e836ce2e5cd2d53aa19901a1359 web
https://github.com/baserproject/basercms/commit/60f83054d8131b0ace60716cec7e629b5eb3a8f0 web
https://github.com/baserproject/basercms package
https://github.com/baserproject/basercms/releases/tag/basercms-4.7.5 web