CVE-2023-51450 is an OS command injection in baserCMS, rated Medium (5.6). The record says prior to 5.0.9 and the site search feature, while the GitHub advisory names the installer. Either way, upgrade to baserCMS 5.0.9.
What's affected
Both sources agree on the fix. baserCMS 5.0.9 contains it, and the record says versions prior to 5.0.9 are affected. The GitHub advisory GHSA-77fc-4cv5-hmfr, published on 22 February 2024 and labeled Moderate 5.6, lists the affected version as 5.0.8 and earlier.
The sources disagree on where the flaw lives. The NVD record says the OS command injection is in the site search feature. The GitHub advisory, which carries the JVN label, describes it as an OS command injection in the Installer feature. I cannot tell from these pages which description is more precise, so the safe course is the same: move to 5.0.9 and check the baserCMS security notice.
The record scores it 5.6 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. GitHub lists the same score under CVSS 3.0. The record's CISA KEV flag is false.
How to check if you're exposed
Check the baserCMS version in the admin dashboard, or read it from the version file in the install:
cat VERSION.txt
On Composer based installs, inspect the lock file:
composer show baserproject/basercms | grep versions
If the version is 5.0.8 or earlier, the site is in scope. If the installer is still present or reachable on a live site, that is a separate hygiene problem worth fixing. Installer routes and files should be removed or blocked after setup, whichever feature turns out to carry the flaw.
Look at web server logs for requests to installer paths and to the search endpoint with unusual characters, if you retain that detail.
What to do now
- Upgrade baserCMS to 5.0.9 or later after a backup.
- Remove or block installer routes on production sites, and confirm that the install lock is in place.
- Run the web server and PHP under an unprivileged account with write access only to the folders it needs.
- Review the baserCMS security notice (JVN) for any follow up steps from the vendor.
- Check logs and recent file changes on sites that ran 5.0.8 or earlier while reachable from the internet.
Why it matters
The record lists CWE-78 (OS Command Injection). This class arises when an application passes user influenced text into a shell command without neutralizing it. The shell then reads parts of that text as commands. The fix is to avoid the shell, pass arguments safely, or validate input strictly.
The score is moderate because attack complexity is rated high and the impact on each of confidentiality, integrity and availability is low in the record's vector. Command injection is still a serious class because the best case for an attacker is code execution as the web server user. The conflict between sources on which feature is affected is a reminder to read the vendor notice, and to patch to the named version instead of reasoning about which route is reachable.
Quick check
Which feature is vulnerable, search or installer?
The sources differ. The NVD record says site search, and the GitHub advisory says the installer. Both name 5.0.9 as the fix, so upgrade and read the baserCMS security notice.
How do I know which version is fixed?
Both the record and the GitHub advisory point to baserCMS 5.0.9. The advisory describes 5.0.8 and earlier as affected.
Sources
- GitHub advisory GHSA-77fc-4cv5-hmfr (fetched)
- baserCMS security notice (listed in the record, not retrieved)
- Gold page for CVE-2023-51450
Last reviewed: 19 October 2026.
