CVE-2026-27697: baserCMS: SQL injection in blog posts
baserCMS versions before 5.2.3 contain a SQL injection vulnerability in blog posts, classified as CWE-89. NVD assigns a CVSS score of 9.8, and the record states the issue is patched in 5.2.3. The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.
Overview
baserCMS is a website development framework. The record describes a SQL injection vulnerability in blog posts affecting versions before 5.2.3, classified as CWE-89. The issue is reported as patched in 5.2.3.
Impact
- NVD assigns a CVSS score of 9.8 with a vector indicating network attack vector, low complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability.
- GitHub as CNA lists a CVSS v4 score of 6.9.
- The SSVC data in the record marks technical impact as partial and the issue as automatable.
The exact data that could be read or modified depends on the blog functionality and deployment, which the record does not detail.
Affected products and versions
- Basercms Basercms: before 5.2.3
- Baserproject Basercms: before 5.2.3
The fixed version is 5.2.3, according to the description and the release reference. The fixes field in the record is empty, which should not be read as the absence of a fix.
Exploitation status
This CVE is not listed in the CISA KEV catalog according to the record, so active exploitation is not confirmed. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.0054 with a percentile of 0.44671, and SSVC exploitation is recorded as none.
Remediation and mitigation
- Upgrade baserCMS to version 5.2.3 or later, as stated in the description and release notes.
- Consult the GitHub security advisory and the JVN advisory for vendor guidance.
- Until the upgrade is applied, limit exposure of administrative and blog-editing functions to trusted networks where feasible.
Detection guidance
- Review web application and database logs for database errors or unusual input on blog post endpoints.
- Inventory baserCMS installations and identify any instance running a version before 5.2.3.
Limitations of the available information
The record does not identify the vulnerable parameter, the specific endpoints, or any preconditions beyond what the CVSS vector expresses. Fixed-version information comes from the description and the release reference because the fixes field is empty.
Frequently asked questions
Which baserCMS versions are affected?
According to the record, versions before 5.2.3 of Basercms Basercms and Baserproject Basercms are affected.
Is this vulnerability being actively exploited?
The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do?
Upgrade to version 5.2.3 or later, consult the vendor advisory, and review logs and inventory for instances still running older versions.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.