CVE-2026-21861: 
PHP vulnerability analysis and mitigation

CVE-2026-21861 is an OS command injection vulnerability (CWE-78) in baserCMS's core update functionality that allows an authenticated administrator to execute arbitrary OS commands on the server. It affects all versions of baserCMS up to and including 5.2.2 (Composer package baserproject/basercms). The vulnerability was published on March 30–31, 2026, and patched in version 5.2.3. It carries a CVSS v3.1 base score of 9.1 (Critical) with Scope: Changed, reflecting potential impact beyond the vulnerable component (GitHub Advisory, baserCMS Release).

The root cause is improper neutralization of OS command special elements (CWE-78) in PluginsController::get_core_update() and PluginsService::getCoreUpdate(). The php parameter from the POST request body is retrieved via $request->getData('php') and concatenated directly into a shell command string passed to PHP's exec() function — without allowlist validation, regex checks, or escapeshellarg() escaping. The vulnerable command construction is: $command = $php . ' ' . ROOT . DS . 'bin' . DS . 'cake.php composer ' . $targetVersion . ' --php ' . $php . ' --dir ' . TMP . 'update';. An attacker with a valid administrator session and CSRF token can send a crafted POST request to /baser/admin/baser-core/plugins/get_core_update with a malicious php parameter to inject arbitrary shell commands (GitHub Advisory).

Successful exploitation allows an authenticated administrator to execute arbitrary OS commands on the server with the privileges of the web server process (e.g., www-data). This enables retrieval of server information, reading and writing arbitrary files, exfiltration of application configuration data including database credentials, and OS-level operations that extend beyond the application's permission boundaries. Because the CVSS scope is marked as Changed, the impact can extend to resources outside the baserCMS application itself, increasing the risk of lateral movement within the hosting environment (GitHub Advisory).

A proof-of-concept (PoC) with concrete reproduction steps — including the affected endpoint, parameter name, example payload (php=php;id>/tmp/rce_test;#), and verified RCE output (uid=1000(www-data)) — is publicly documented in the official security advisory (GitHub Advisory). Feedly threat intelligence classifies this as a real exploit with high confidence. The EPSS score is approximately 0.137% (33rd percentile), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. Exploitation requires authenticated administrator access, which limits the attack surface but does not eliminate risk in environments where admin credentials may be compromised or shared.

1. Authenticate as Administrator: Log in to the baserCMS admin panel with valid administrator credentials to obtain a session cookie and a valid CSRF/FormProtection token.
2. Identify the vulnerable endpoint: Target the core update endpoint at /baser/admin/baser-core/plugins/get_core_update via HTTP POST.
3. Craft the malicious payload: Construct a POST body with the php parameter containing an OS command injection string, e.g., php=php;id>/tmp/rce_test;#. The semicolons terminate the intended PHP binary path and inject a new shell command; the # comments out the remainder of the constructed command string.
4. Send the request: Submit the POST request with the valid session cookie and CSRF token (obtainable from the legitimate admin UI or by replaying a captured request using curl or a proxy tool like Burp Suite).
5. Verify execution: Confirm command execution by checking the output file (e.g., cat /tmp/rce_test) or by using an out-of-band technique (e.g., DNS/HTTP callback) to verify the injected command ran as the web server user (www-data).
6. Escalate or persist: Use the RCE capability to read sensitive files (e.g., database credentials from config files), write web shells, or perform further lateral movement within the server environment (GitHub Advisory).

• Network: Unexpected POST requests to /baser/admin/baser-core/plugins/get_core_update containing unusual characters in the php parameter (e.g., semicolons, >, #, pipe characters, or command names like id, whoami, curl, wget).
• File System: Unexpected files created in /tmp/ or other world-writable directories (e.g., /tmp/rce_test); new or modified PHP files in the web root that could serve as web shells; unauthorized changes to application configuration files.
• Logs: Web server access logs showing POST requests to the core update endpoint with anomalous php parameter values; PHP error logs or application logs showing unexpected exec() output or command failures.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., sh, bash, id, curl, wget, python) visible in process monitoring tools; unexpected outbound network connections from the web server process (GitHub Advisory).

Upgrade baserCMS to version 5.2.3 or later, which patches this vulnerability by removing user-controlled input from the PHP executable path and using the server-side PHP_BINARY constant instead (baserCMS Release). As a workaround prior to patching, restrict administrative panel access to trusted IP addresses only and enforce strong, unique credentials for all administrator accounts. Additionally, monitor server logs for suspicious POST requests to the core update endpoint and audit web server process activity for unexpected child process spawning (GitHub Advisory).

The vulnerability was reported by researcher kaminuma and published by ryuring via the baserCMS GitHub security advisory process. Coverage appeared on The Hacker Wire and security aggregators including cvefeed.io, VulDB, and INCIBE-CERT shortly after disclosure. Social media discussion was noted on Mastodon (infosec.exchange) and Bluesky. No major vendor statements beyond the official baserCMS advisory and release notes have been identified (GitHub Advisory, baserCMS Release).