CVE-2018-18942

RCE in baserCMS before 4.1.4

7.2 HighFix available

CVE-2018-18942 is a high vulnerability (CVSS 7.2) in Basercms, published November 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. Fixed in baserproject/basercms 4.1.4.

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.40%Up 1.4 points since Apr 14, 2021

What each source reports

NVD Score used 7.2

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

Record: CVE-2018-18942
CVSS 3.0: 7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-434
Updated: 2026-11-02

CVE List No score

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

Record: CVE-2018-18942
Updated: 2026-11-02

EUVDEUVD-2022-5187 No score

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

Record: EUVD-2022-5187
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rjc2-x53r-6c9r 7.2

RCE in baserCMS before 4.1.4

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

Record: GHSA-rjc2-x53r-6c9r
CVSS 3.0: 7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

OSV 7.2

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

Record: CVE-2018-18942
CVSS 3.0: 7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-rjc2-x53r-6c9r 7.2

RCE in baserCMS before 4.1.4

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

Record: GHSA-rjc2-x53r-6c9r
CVSS 3.0: 7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

Affected products

basercms

Affected packages

Affected packages
Package	Affected	Fixed
`baserproject/basercms` Packagist	before 4.1.4	4.1.4
`baserproject/basercms` Packagist	before 4.1.4, plus listed versions 0.0.10.0.20.0.30.0.40.0.5 Show 45 moreShow less 0.0.60.0.70.0.81.0.02.0.0-rc12.0.0-rc22.0.0-rc32.0.0-rc42.0.0-rc52.0.0-rc63.0.103.0.10.13.0.113.0.11.13.0.123.0.133.0.143.0.153.0.163.0.173.0.183.0.193.0.203.0.213.0.223.0.233.0.243.0.253.0.263.0.73.0.7.13.0.83.0.8.13.0.93.0.9.14.0.04.0.0-beta4.0.14.0.104.0.10.14.0.114.0.24.0.2.14.0.34.0.4	4.1.4

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 12 versions. The JSON record has them.