high CVSS 8.7

CVE-2025-32957·PHP vulnerability

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.

Severity
high
Software
PHP
Fixed in
5.2.3
Published
2026-03-31

Affected versions

Until: 5.2.3

Fixed in: 5.2.3

How to fix this CVE

Update baserCMS to version 5.2.3 or later, which implements proper file validation and restricts PHP file inclusion during the restore process. If you are running baserCMS on a PHP-based system, ensure PHP is also up-to-date and review your backup restoration procedures to prevent unauthorized file uploads. Restrict access to the restore/backup management interface using authentication and IP whitelisting.

sudo dnf update php

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /admin/backups/restore or similar restore endpoint with multipart/form-data containing .zip file upload followed by require_once or include operations on extracted files; detection pattern: `(POST.*restore|upload.*zip).*require_once|include.*\$_(FILES|REQUEST)`

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Block or restrict POST requests to backup/restore management endpoints to authenticated users only; implement file type validation to reject .zip uploads containing .php files; add WAF rules to detect and block include/require statements with user-controlled variables in POST parameters

How to check if you are affected

  1. Step 1: Check installed PHP version with `php -v` and verify if baserCMS version is below 5.2.3 by examining the version file at `{basercms_root}/VERSION.txt` or `{basercms_root}/composer.json`
  2. Step 2: Verify if the restore/backup functionality is exposed by checking for accessible backup management URLs (typically `/admin/backups/restore` or similar) and confirming authentication requirements are in place
  3. Step 3: Search application logs and web server logs for suspicious .zip file uploads to backup/restore endpoints using `grep -r '\.zip' /var/log/apache2/` or `grep -r '\.zip' /var/log/nginx/`
  4. Step 4: After updating to baserCMS 5.2.3, confirm the fix by checking the restore function code includes file validation: `grep -n 'require_once' {basercms_root}/app/*/controllers/*restore*` to verify no direct includes without filtering

FAQ

What is CVE-2025-32957?

CVE-2025-32957 is a critical vulnerability in baserCMS versions prior to 5.2.3 where the backup restore function fails to validate PHP filenames before inclusion, allowing attackers to upload malicious PHP files within a ZIP archive and execute arbitrary code on the server.

Is CVE-2025-32957 being actively exploited?

No, this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available, though the attack technique is straightforward and organizations should treat this with high priority.

What versions of baserCMS are affected by CVE-2025-32957?

All versions of baserCMS prior to 5.2.3 are affected; baserCMS 5.2.3 and later contain the security patch.

How do I check if my server is vulnerable to CVE-2025-32957?

Check your baserCMS version with `cat {basercms_root}/VERSION.txt` or inspect `composer.json`; if the version is below 5.2.3, your installation is vulnerable.

Does Defensia detect CVE-2025-32957?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If baserCMS or PHP is installed on a monitored server, CVE-2025-32957 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2026-28289CVSS 10FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2025-32957. Free for 1 server.

Get started free