Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5ay3-1t5g-vycu
Vulnerability ID VCID-5ay3-1t5g-vycu
Aliases CVE-2021-41279
GHSA-4x2f-54wr-4hjg
Summary Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') BaserCMS is an open source content management system with a focus on Japanese language support. Users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00438 https://api.first.org/data/v1/epss?cve=CVE-2021-41279
epss 0.00438 https://api.first.org/data/v1/epss?cve=CVE-2021-41279
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-4x2f-54wr-4hjg
cvssv3.1 7.7 https://github.com/baserproject/basercms
generic_textual HIGH https://github.com/baserproject/basercms
cvssv3.1 7.7 https://github.com/baserproject/basercms/commit/d8ab0a81a7bce35cc95ff7dff851a7e87a084336
generic_textual HIGH https://github.com/baserproject/basercms/commit/d8ab0a81a7bce35cc95ff7dff851a7e87a084336
cvssv3.1 7.7 https://github.com/baserproject/basercms/security/advisories/GHSA-4x2f-54wr-4hjg
cvssv3.1_qr HIGH https://github.com/baserproject/basercms/security/advisories/GHSA-4x2f-54wr-4hjg
generic_textual HIGH https://github.com/baserproject/basercms/security/advisories/GHSA-4x2f-54wr-4hjg
cvssv3.1 7.7 https://nvd.nist.gov/vuln/detail/CVE-2021-41279
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-41279
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-41279
https://github.com/baserproject/basercms
https://github.com/baserproject/basercms/commit/d8ab0a81a7bce35cc95ff7dff851a7e87a084336
CVE-2021-41279 https://nvd.nist.gov/vuln/detail/CVE-2021-41279
GHSA-4x2f-54wr-4hjg https://github.com/advisories/GHSA-4x2f-54wr-4hjg
GHSA-4x2f-54wr-4hjg https://github.com/baserproject/basercms/security/advisories/GHSA-4x2f-54wr-4hjg
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/baserproject/basercms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/baserproject/basercms/commit/d8ab0a81a7bce35cc95ff7dff851a7e87a084336
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/baserproject/basercms/security/advisories/GHSA-4x2f-54wr-4hjg
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41279
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.63447
EPSS Score 0.00438
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:40:36.413827+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/baserproject/basercms/CVE-2021-41279.yml 38.6.0