https://feed.craftedsignal.io/products/bcthemefile-plugin-5.2.3-before-5.3.2-5.4.0-before-5.4.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 19:57:53 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-basercms-path-traversal/Thu, 29 Oct 2026 19:57:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-basercms-path-traversal/A path traversal vulnerability exists in the BcThemeFile plugin for baserCMS where percent-encoded traversal sequences bypass validation, allowing an authenticated administrator to write PHP files outside the intended theme directory.CVE-2026-114622 affects the optional BcThemeFile plugin in baserCMS versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2. The Admin API performs validation before applying rawurldecode() to path inputs. Because normalizePath() only resolves literal dot segments, percent-encoded traversal sequences can bypass containment checks. An authenticated administrator can exploit this to write PHP files into writable locations, such as the webroot, exceeding the intended theme-template editing boundary. This issue is a bypass of protections associated with CVE-2026-30940.

]]>highadvisory