CVE-2025-32957 baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE)

What is CVE-2025-32957?

CVE-2025-32957 is a high-severity vulnerability in Basercms Basercms, published on 31 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.

Weakness: CWE-434

Which versions are affected by CVE-2025-32957?

2 open source packages ship an affected version, including baserproject/basercms. It affects 1 product.

Products include Basercms Basercms.

How do I fix CVE-2025-32957?

Upgrade baserproject/basercms to 5.2.3 or later.

Is CVE-2025-32957 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32957 exists.

Other vulnerabilities in Basercms Basercms

• CVE-2023-25654 baserCMS File Uploader Remote Code Execution (RCE) vulnerability Critical 9.8
• CVE-2023-25655 baserCMS allows any file to be uploaded Critical 9.8
• CVE-2017-10842 baserCMS SQL Injection vulnerability Critical 9.8
• CVE-2026-30880 baserCMS: OS command injection vulnerability in installer Critical 9.2
• CVE-2026-21861 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) Critical 9.1

All Basercms Basercms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hv78-cwp4-8r7r.