What is GHSA-6hpg-8rx3-cwgv?

GHSA-6hpg-8rx3-cwgv is a security advisory published by GitHub Security Advisories with Critical severity. baserCMS has OS command injection vulnerability in installer

Which CVE IDs does GHSA-6hpg-8rx3-cwgv cover?

GHSA-6hpg-8rx3-cwgv covers the following CVE IDs: CVE-2026-30880. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-6hpg-8rx3-cwgv?

GHSA-6hpg-8rx3-cwgv affects 1 product, including: composer/baserproject/basercms:\u003c= 5.2.2.

GHSA-6hpg-8rx3-cwgvCritical

baserCMS has OS command injection vulnerability in installer

Vendor

GitHub Security Advisories

Published

March 31, 2026

Last Modified

March 31, 2026

🔗 CVE IDs covered (1)

CVE-2026-30880 →

📋 Description

baserCMS has an OS command injection vulnerability in the installer.

Target

baserCMS 5.2.2 and earlier versions

Vulnerability

If baserCMS is placed on a server but not installed, malicious commands may be executed.

Countermeasures

Update to the latest version of baserCMS

Please refer to the following page to reference for more information. https://basercms.net/security/JVN_54513170

Credits

REN XINGDIAN

🎯 Affected products1

composer/baserproject/basercms:<= 5.2.2

🔗 References (5)

https://github.com/baserproject/basercms/security/advisories/GHSA-6hpg-8rx3-cwgv
https://nvd.nist.gov/vuln/detail/CVE-2026-30880
https://basercms.net/security/JVN_20837860
https://github.com/baserproject/basercms/releases/tag/5.2.3
https://github.com/advisories/GHSA-6hpg-8rx3-cwgv