CVE-2026-21861

CVE-2026-21861 is an OS command injection vulnerability affecting baserCMS versions prior to 5.2.3, where an authenticated administrator can execute arbitrary operating system commands on the server. This critical flaw, rated 7.2 HIGH, arises from improper handling of user-controlled input within the core update functionality, leading to potential full system compromise. Although there is no evidence of active exploitation or public exploit code, the vulnerability has received community attention, with discussions emphasizing its critical impact and the urgent need for patching to version 5.2.3 or later.