CVE-2026-27697 is a critical SQL injection (CVSS 9.8) in baserCMS, a Japanese website development framework. It sits in the blog post handling and is fixed in version 5.2.3. If you run baserCMS 5.0.0 through 5.2.2, update to 5.2.3 or later.
What's affected
The record says baserCMS before 5.2.3 has a SQL injection vulnerability in blog posts. The project's security notice gives the affected range as baserCMS 5.0.0 to 5.2.2, and the fix as updating to the latest version.
The notice is a bundle. It lists nine issues in total, including cross site scripting, OS command injection and path traversal items, with this SQL injection in the blog post list as one of them. The notice says several of the others only matter if you give the admin screen to many unknown users. Update to 5.2.3 or later to cover the whole set, not just this one.
How to check if you're exposed
Check which baserCMS version your site runs, using the admin screen or the version information in your installation. If the number is between 5.0.0 and 5.2.2, you are in the affected range.
Then ask whether the public blog is reachable from the internet. A public blog list is the kind of page an unauthenticated visitor can load.
What to do now
- Back up the site and database.
- Update baserCMS to 5.2.3 or later by the project's update route.
- Read the full security notice, since it covers eight other issues, and make sure your admin area is not open to unknown users.
- Review web server and database logs for unusual requests to blog list pages.
- If you suspect exposure, rotate admin credentials and check for unexpected accounts.
Why it matters
This is CWE-89, SQL injection. Request data used while listing blog posts is placed into a database query without safe handling, so an attacker may change what the query does. The record scores confidentiality, integrity and availability impact all as high, and requires no login.
Content management systems are common targets because they are everywhere and often run unattended. The thing to do is boring and effective: keep them on current releases, and keep an inventory so you know which sites run which version.
Quick check
Does the notice cover only SQL injection?
No. It lists nine issues in baserCMS 5.0.0 to 5.2.2, and says to update to the latest version.
Sources
Last reviewed: 19 October 2026.
