CVE-2026-114624
Deferred Deferred - Pending Action

PHP Object Injection in baserCMS Widget Serialization

Publication date: 2026-10-23

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests. Two demonstrated gadget chains in the default dependency set use composer/composer ProcessExecutor::startJob() with Process::fromShellCommandline(), or logiscape/mcp-sdk-php StdioTransport::connect() with StdioServerParameters, to reach proc_open() and execute commands as the web-server user. Deserialization bypasses constructor-based readonly safeguards, and the stored payload can execute repeatedly until the database row is repaired. Unauthenticated page access is a trigger after privileged payload storage, not an unauthenticated means of initially planting the payload. This issue has been patched in versions 5.3.2 and 5.4.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-23
Last Modified
2026-10-23
Generated
2026-10-23
AI Q&A
2026-10-23
EPSS Evaluated
N/A
NVD
CVE-2026-114624
EUVD
EUVD-2026-108995

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
baserproject basercms >= 5.0.0, < 5.3.2
baserproject basercms >= 5.4.0, < 5.4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in baserCMS versions 5.0.0 to 5.3.1 and 5.4.0 to 5.4.1 allows an attacker with widget-write capability to store a malicious serialized object in the database. When the widget is rendered, the unserialize function without allowed_classes restriction executes the payload, potentially leading to arbitrary command execution as the web-server user.

Detection Guidance

Check baserCMS versions for 5.0.0 to 5.3.1 or 5.4.0 to 5.4.1. Inspect widget-area entities for serialized data in the database. Look for unusual admin JSON API submissions or unserialize() usage without allowed_classes restrictions.

Impact Analysis

An attacker could exploit this to execute arbitrary commands on your server, potentially gaining control over the system. This could lead to data theft, defacement, or further compromise of your infrastructure. The impact is severe as it allows remote code execution with the privileges of the web server user.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Upgrade baserCMS to versions 5.3.2 or 5.4.2 or later. Remove any unauthorized widgets or serialized payloads from the database. Restrict admin JSON API access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart