CVE-2026-30940: baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API

March 31, 2026

A path traversal vulnerability exists in the baserCMS 5.x theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write.

An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE).

References

basercms.net/security/JVN_20837860
github.com/advisories/GHSA-c5c6-37vq-pjcq
github.com/baserproject/basercms
github.com/baserproject/basercms/releases/tag/5.2.3
github.com/baserproject/basercms/security/advisories/GHSA-c5c6-37vq-pjcq
nvd.nist.gov/vuln/detail/CVE-2026-30940

Code Behaviors & Features

Detect and mitigate CVE-2026-30940 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →