CVE-2026-115481Published
baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-115481 · Microsoft / collected KEV context
cve-program · CVE-2026-115481
- https://github.com/baserproject/basercms/security/advisories/GHSA-8jrp-4h7c-m679
- https://github.com/baserproject/basercms/commit/2ed19c878add5c26fc765572e0e77173c1f1fdb5
- https://github.com/baserproject/basercms/commit/b0ef31b10dc6267b48ebc9a80d34bc7c4c09c311
- https://github.com/baserproject/basercms/releases/tag/5.3.2
- https://github.com/baserproject/basercms/releases/tag/5.4.2
Related operational evidence
Explicit CVE identifiers- baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload · Newly collected advisory · 23 Oct 2026