CVE-2026-97150

Published: Set 30, 2026 Last Modified: Set 30, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 7,2
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

When converting baserCMS4-style addons to baserCMS5-style ones,
BcAddonMigrator includes 'config.php' from the addon, which means the PHP code in the file is executed.
Arbitrary files on the system may be read or deleted by an administrative user.

829

Inclusion of Functionality from Untrusted Control Sphere

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
View CWE Details
https://basercms.net/security/JVN_21754394
https://basercms.net/security/JVN_21754394
https://github.com/baserproject/BcAddonMigrator/commit/e836…
https://github.com/baserproject/BcAddonMigrator/commit/e836bc875e26910e1b5862f9…
https://jvn.jp/en/jp/JVN21754394
https://jvn.jp/en/jp/JVN21754394