CVE-2026-76635 baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php
Authenticated administrators can exploit SQL injection and code injection flaws in baserCMS to execute arbitrary code and read sensitive database information.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76635?
CVE-2026-76635 is a high-severity SQL injection vulnerability in baserproject basercms, published on 20 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend.
Which versions are affected by CVE-2026-76635?
How do I fix CVE-2026-76635?
No fix has been published for CVE-2026-76635 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-76635 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-76635 exists.
Sources
Also known as GHSA-cg65-f2m7-9fqj, GHSA-p3p6-469g-p4j2.