CVE-2026-97150
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitra…
Published: 2026-09-30 · CVSS: 8.6 · CVSS 4.0
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7