What is GHSA-m3wp-gxpc-2c5q?

GHSA-m3wp-gxpc-2c5q is a security advisory published by GitHub Security Advisories with High severity. When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config...

Which CVE IDs does GHSA-m3wp-gxpc-2c5q cover?

GHSA-m3wp-gxpc-2c5q covers the following CVE IDs: CVE-2026-97150. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m3wp-gxpc-2c5q?

GHSA-m3wp-gxpc-2c5q has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-m3wp-gxpc-2c5qHighCVSS 7.2

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config...

Vendor

GitHub Security Advisories

Published

September 30, 2026

Last Modified

September 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-97150 →

📋 Description

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-97150
https://github.com/baserproject/BcAddonMigrator/commit/e836bc875e26910e1b5862f96cf280b4f064c104
https://basercms.net/security/JVN_21754394
https://jvn.jp/en/jp/JVN21754394
https://github.com/advisories/GHSA-m3wp-gxpc-2c5q