CVE-2023-43648 baserCMS Directory Traversal vulnerability in Form submission data management Feature
An attacker can exploit a directory traversal flaw in baserCMS form submission data management to read arbitrary files from the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-43648?
CVE-2023-43648 is a medium-severity path traversal vulnerability in Basercms Basercms, published on 30 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue.
Weakness: CWE-22
Which versions are affected by CVE-2023-43648?
2 open source packages ship an affected version, including baserproject/basercms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
baserproject/basercms Packagist | All versions | 4.8.0 |
baserproject/basercms Packagist | All versions | 4.8.0 |
Products include Basercms Basercms.
How do I fix CVE-2023-43648?
Upgrade baserproject/basercms to 4.8.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-43648 being exploited?
There is no known exploitation of CVE-2023-43648 in the wild and no public exploit code.
Other vulnerabilities in Basercms Basercms
- CVE-2023-25654 baserCMS File Uploader Remote Code Execution (RCE) vulnerability
- CVE-2023-25655 baserCMS allows any file to be uploaded
- CVE-2017-10842 baserCMS SQL Injection vulnerability
- CVE-2026-30880 baserCMS: OS command injection vulnerability in installer
- CVE-2026-21861 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)
Sources
Also known as GHSA-hmqj-gv2m-hq55.