CVE-2026-30880 is a critical OS command injection (CVSS 9.8) in the installer of baserCMS before version 5.2.3. The fix is in 5.2.3. Upgrade, and make sure any installer path on a live site is not reachable from the internet.
What's affected
baserCMS versions before 5.2.3 are affected. The patched version is 5.2.3. The record gives no further detail about the vulnerable parameter, so read the project's advisory for specifics.
How to check if you're exposed
Check the version in the baserCMS admin area or on your deployment record, and compare it with 5.2.3.
The weakness is in the installer, so also check whether the installer is still reachable on your site. A finished installation should not leave an installer route open to visitors.
What to do now
- Upgrade baserCMS to 5.2.3 or later.
- Confirm the installer is disabled or removed on every production site.
- Run the web server as an unprivileged user so a command injection has little to work with.
- Read the JVN notice and the GitHub advisory for any extra guidance.
Why it matters
The weakness class is CWE-78, OS command injection. Input reaches a shell command without being neutralized, so the shell can treat part of it as a command.
The record is short and the vendor advisory is the best source for details. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Does it matter if my site is already installed?
The flaw is in the installer. An installed site that still exposes installer routes could be at risk, so upgrade either way.
Sources
- baserCMS security advisory GHSA-6hpg-8rx3-cwgv
- JVN notice
- baserCMS 5.2.3 release
- NVD record for CVE-2026-30880
Last reviewed: 19 October 2026.
