---
title: "CVE-2026-21861: baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)"
url: https://erroneo.us/security/cve/CVE-2026-21861/
description: "CVE-2026-21861 (baserproject/basercms (Composer (PHP))): baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-03-31
date_modified: 2026-03-31
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-21861"
kev: false
cvss: 9.1
epss: 0.02282
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-21861: baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 2.3% , percentile 83: FIRST’s model estimates a 2.3% chance of exploitation activity in the next 30 days, higher than 83% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.
- Only applies if your dependency tree includes baserproject/basercms (Composer (PHP)) <= 5.2.2, fixed in 5.2.3 . Check your lockfile, including transitive dependencies.

## What it is

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.

## Affected packages

- Composer (PHP) `baserproject/basercms` <= 5.2.2 → fixed: 5.2.3

## Affected products (CVE record)

- baserproject basercms: < 5.2.3

## Severity

- GitHub_M CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 2.28% probability of exploitation activity in the next 30 days; percentile 83.

## Sources

- [GitHub Advisory GHSA-qxmc-6f24-g86g](https://github.com/advisories/GHSA-qxmc-6f24-g86g)
- [CVE.org record CVE-2026-21861](https://www.cve.org/CVERecord?id=CVE-2026-21861)
- [NVD entry CVE-2026-21861](https://nvd.nist.gov/vuln/detail/CVE-2026-21861)
- [github.com](https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g)
- [basercms.net](https://basercms.net/security/JVN_20837860)
- [github.com](https://github.com/baserproject/basercms/releases/tag/5.2.3)

---
Source page: https://erroneo.us/security/cve/CVE-2026-21861/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt