CVE-2018-0571
baserCMS arbitrary file upload vulnerability
CVE-2018-0571 is a medium vulnerability (CVSS 4.3) in Basercms, published June 26, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 65th percentile. Fixed in baserproject/basercms 4.1.1.
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
- Record
CVE-2018-0571- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
- Record
CVE-2018-0571- Updated
- 2026-11-02
EUVDEUVD-2022-2210 No score
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
- Record
EUVD-2022-2210- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3mcp-6rv6-c69g
baserCMS arbitrary file upload vulnerability
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
- Record
GHSA-3mcp-6rv6-c69g- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
OSV
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
- Record
CVE-2018-0571- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-3mcp-6rv6-c69g
baserCMS arbitrary file upload vulnerability
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
- Record
GHSA-3mcp-6rv6-c69g- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
baserproject/basercmsPackagist |
4.0.0 to 4.1.0.1 | 4.1.1 |
baserproject/basercmsPackagist |
through 3.0.15 | 3.0.16 |
baserproject/basercmsPackagist |
4.0.0 up to 4.1.1, plus listed versions 4.0.14.0.104.0.10.14.0.114.0.2 Show 12 moreShow less4.0.2.14.0.34.0.44.0.54.0.5.14.0.5.24.0.64.0.74.0.84.0.94.1.04.1.0.1 |
4.1.1 |
baserproject/basercmsPackagist |
before 3.0.16, plus listed versions 0.0.10.0.20.0.30.0.40.0.5 Show 24 moreShow less0.0.60.0.70.0.81.0.02.0.0-rc12.0.0-rc22.0.0-rc32.0.0-rc42.0.0-rc52.0.0-rc63.0.103.0.10.13.0.113.0.11.13.0.123.0.133.0.143.0.153.0.73.0.7.13.0.83.0.8.13.0.93.0.9.1 |
3.0.16 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |