CVE-2026-97150 PUBLISHED

Assigner: jpcert
Reserved: 24.09.2026 Published: 30.09.2026 Updated: 30.09.2026

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.6

Product Status

Vendor baserCMS Users Community
Product BcAddonMigrator
Versions Default: unaffected
  • affected from 0 to 5.2.0 (incl.)

References

Problem Types