---
cve: "CVE-2026-97150"
severity: "HIGH"
cvss: 8.6
epss: "0.3%"
vendor: "baserCMS Users Community"
kev: false
exploited: false
published: "2026-09-30 08:16:36"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-02T01:01:49+02:00"
---

# CVE-2026-97150

> 8.6 HIGH · 🧪 PoC

## Beschreibung

When converting baserCMS4-style addons to baserCMS5-style ones,
BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed.
Arbitrary files on the system may be read or deleted by an administrative user.

## CNA-Record (Kanon, cvelistV5)

- CNA: **jpcert**
- State: PUBLISHED
- Stand: 2026-09-30 14:38:59
- CNA-CVSS: **8.6** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Hoch | good |
| UI Interaktion | Keine | bad |

## Referenzen

- <https://jvn.jp/en/jp/JVN21754394>
- <https://basercms.net/security/JVN_21754394>
- <https://github.com/baserproject/BcAddonMigrator/commit/e836bc875e26910e1b5862f96cf280b4f064c104>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-97150) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_