baserCMS: BcThemeFile plugin arbitrary file write (CVE-2026-114622)
A path traversal vulnerability exists in the BcThemeFile plugin for baserCMS where percent-encoded traversal sequences bypass validation, allowing an authenticated administrator to write PHP files outside the intended theme directory.
CVE search metadata
CVE search record: CVE-2026-114622. KEV: no. Product: BcThemeFile plugin (5.2.3 before 5.3.2, 5.4.0 before 5.4.2). Brief: baserCMS: BcThemeFile plugin arbitrary file write (CVE-2026-114622). Brief link: https://feed.craftedsignal.io/briefs/2026-10-basercms-path-traversal/
CVE search record: CVE-2026-30940. KEV: no. Product: BcThemeFile plugin (5.2.3 before 5.3.2, 5.4.0 before 5.4.2). Brief: baserCMS: BcThemeFile plugin arbitrary file write (CVE-2026-114622). Brief link: https://feed.craftedsignal.io/briefs/2026-10-basercms-path-traversal/
Triage facts
Revision 1- Applicability
- BcThemeFile plugin (5.2.3 before 5.3.2, 5.4.0 before 5.4.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 19:57 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A2Roughly even chance
CVE-2026-114622 affects the optional BcThemeFile plugin in baserCMS versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2. The Admin API performs validation before applying rawurldecode() to path inputs. Because normalizePath() only resolves literal dot segments, percent-encoded traversal sequences can bypass containment checks. An authenticated administrator can exploit this to write PHP files into writable locations, such as the webroot, exceeding the intended theme-template editing boundary. This issue is a bypass of protections associated with CVE-2026-30940.