CVE-2026-27697
Received Received - Intake
SQL Injection in baserCMS Blog Posts Allows Data Exposure

Publication date: 2026-03-31

Last updated on: 2026-04-01

Assigner: GitHub, Inc.

Description
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-31
Last Modified
2026-04-01
Generated
2026-06-16
AI Q&A
2026-03-31
EPSS Evaluated
2026-06-14
NVD
CVE-2026-27697
EUVD
EUVD-2026-17257
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
basercms basercms to 5.2.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-27697 is a SQL injection vulnerability in baserCMS affecting blog posts in versions 5.2.2 and earlier.

This vulnerability allows attackers to remotely execute malicious SQL commands without needing any privileges or user interaction.

It is classified as moderate severity with a CVSS v4 base score of 6.9.

Impact Analysis

An attacker exploiting this vulnerability can cause limited unauthorized data disclosure, modification, or service disruption on the affected baserCMS system.

The impact on confidentiality, integrity, and availability is considered low.

No further system impacts beyond these have been reported.

Mitigation Strategies

To mitigate the SQL injection vulnerability in baserCMS blog posts, you should update baserCMS to version 5.2.3 or later, where the issue has been patched.

This update removes the vulnerability that allows remote attackers to execute malicious SQL commands without any privileges or user interaction.

Compliance Impact

The provided information does not specify any direct impact of this SQL injection vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart