CVE-2025-32957: 
PHP vulnerability analysis and mitigation

CVE-2025-32957 is an unsafe file upload vulnerability in baserCMS that enables authenticated attackers with high privileges to achieve Remote Code Execution (RCE) via the application's restore function. The flaw affects baserCMS versions 5.2.2 and earlier (all versions prior to 5.2.3). It was published on March 30–31, 2026, and patched in version 5.2.3. The CVSS v3.1 base score is 8.7 (High) per the GitHub Advisory, or 7.2 (High) per NVD (GitHub Advisory, baserCMS Release).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), located in BcDatabasesService.php. The restore function accepts a user-supplied .zip archive, automatically extracts it, and then includes a PHP file from the archive using require_once without validating or restricting the filename. An attacker with administrative access can craft a malicious ZIP containing a PHP web shell or payload; when the restore function processes the archive, the PHP file is executed server-side. The attack vector is network-based, requires high privileges (admin account), no user interaction, and has low attack complexity (GitHub Advisory, baserCMS Security Advisory).

Successful exploitation grants an attacker arbitrary code execution on the server running baserCMS, enabling full system compromise. This includes unauthorized access to sensitive data (high confidentiality impact), modification of application files and server content (high integrity impact), and potential lateral movement within the hosting infrastructure. The scope is marked as "Changed" in the GitHub Advisory CVSS scoring, indicating that the impact can extend beyond the vulnerable component itself (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available on GitHub at https://github.com/toratako/CVE-2025-32957-PoC, though the advisory-level PoC consists primarily of annotated screenshots rather than runnable exploit code (GitHub Advisory). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.033% (10th percentile), indicating a low near-term exploitation probability. This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing baserCMS instances running version 5.2.2 or earlier using web fingerprinting tools or Shodan searches for baserCMS-specific headers or paths.
2. Obtain admin credentials: Exploit weak credentials, credential stuffing, or social engineering to gain access to a high-privilege (administrator) baserCMS account, as the restore function requires admin-level access.
3. Craft malicious ZIP archive: Create a .zip file containing a PHP web shell (e.g., shell.php with <?php system($_GET['cmd']); ?>) at the expected path within the archive structure.
4. Upload via restore function: Navigate to the baserCMS admin panel's database restore feature and upload the crafted ZIP archive.
5. Trigger code execution: The application automatically extracts the ZIP and includes the PHP file via require_once without filename validation, executing the embedded PHP payload on the server.
6. Achieve RCE: Access the deployed web shell or observe command output to execute arbitrary OS commands, exfiltrate data, or establish persistence (GitHub Advisory, baserCMS Security Advisory).

• Network: Unusual HTTP POST requests to the baserCMS restore/database backup endpoint from admin sessions; outbound connections from the web server to unknown external IPs following a restore operation.
• File System: Unexpected .php files in the baserCMS upload or restore extraction directory (e.g., webroot/files/ or temporary extraction paths); newly created web shells with names like shell.php, cmd.php, or similar.
• Logs: Web server access logs showing POST requests to the restore function endpoint followed by GET/POST requests to newly created PHP files; PHP error logs referencing require_once with unexpected filenames from extracted ZIP contents.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, curl, wget, python) shortly after a restore operation is performed (GitHub Advisory).

Upgrade baserCMS to version 5.2.3 or later, which patches this vulnerability (baserCMS Release, baserCMS Security Advisory). As interim mitigations, restrict access to the admin panel (including the restore function) to only trusted IP addresses or VPN users, and limit the number of accounts with administrative privileges. Additionally, implement server-side filename validation and content-type checks for uploaded archives, and consider disabling the restore function entirely if it is not operationally required.

The vulnerability was covered by The Hacker Wire, which published a brief technical summary shortly after disclosure (The Hacker Wire). Community discussion was noted on Mastodon and Bluesky, with security aggregators such as CVEFeed and VulDB indexing the issue. The baserCMS development team credited researchers MinhhhCuonggg and Vatvo69 as finders in the official advisory (GitHub Advisory). No major vendor statements beyond the official patch release have been identified.