{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-02T07:47:42.327","vulnerabilities":[{"cve":{"id":"CVE-2026-30940","sourceIdentifier":"security-advisories@github.com","published":"2026-03-31T01:16:36.430","lastModified":"2026-06-17T10:33:11.443","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3."},{"lang":"es","value":"baserCMS es un framework de desarrollo de sitios web. Antes de la versión 5.2.3, existe una vulnerabilidad de salto de ruta en la API de gestión de archivos de temas (/baser/api/admin/bc-theme-file/theme_files/add.json) que permite la escritura arbitraria de archivos. Un administrador autenticado puede incluir secuencias ../ en el parámetro de ruta para crear un archivo PHP en un directorio arbitrario fuera del directorio de temas, lo que puede resultar en ejecución remota de código (RCE). Este problema ha sido parcheado en la versión 5.2.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"baserproject","product":"basercms","versions":[{"version":"< 5.2.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-02T14:46:24.039682Z","id":"CVE-2026-30940","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*","versionEndExcluding":"5.2.3","matchCriteriaId":"07DEEEF3-0621-431D-8A38-405EDBD0957E"}]}]}],"references":[{"url":"https://basercms.net/security/JVN_20837860","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/baserproject/basercms/releases/tag/5.2.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/baserproject/basercms/security/advisories/GHSA-c5c6-37vq-pjcq","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}}]}