Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-891u-x525-ykbb
Vulnerability ID VCID-891u-x525-ykbb
Aliases CVE-2021-41243
GHSA-7rpc-9m88-cf9w
Summary Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.02799 https://api.first.org/data/v1/epss?cve=CVE-2021-41243
epss 0.02799 https://api.first.org/data/v1/epss?cve=CVE-2021-41243
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-7rpc-9m88-cf9w
cvssv3.1 9.1 https://github.com/baserproject/basercms
generic_textual CRITICAL https://github.com/baserproject/basercms
cvssv3.1 9.1 https://github.com/baserproject/basercms/commit/9088b99c329d1faff3a2f1269f37b9a9d8d5f6ff
generic_textual CRITICAL https://github.com/baserproject/basercms/commit/9088b99c329d1faff3a2f1269f37b9a9d8d5f6ff
cvssv3.1 9.1 https://github.com/baserproject/basercms/security/advisories/GHSA-7rpc-9m88-cf9w
cvssv3.1_qr CRITICAL https://github.com/baserproject/basercms/security/advisories/GHSA-7rpc-9m88-cf9w
generic_textual CRITICAL https://github.com/baserproject/basercms/security/advisories/GHSA-7rpc-9m88-cf9w
cvssv3.1 9.1 https://nvd.nist.gov/vuln/detail/CVE-2021-41243
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2021-41243
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-41243
https://github.com/baserproject/basercms
https://github.com/baserproject/basercms/commit/9088b99c329d1faff3a2f1269f37b9a9d8d5f6ff
CVE-2021-41243 https://nvd.nist.gov/vuln/detail/CVE-2021-41243
GHSA-7rpc-9m88-cf9w https://github.com/advisories/GHSA-7rpc-9m88-cf9w
GHSA-7rpc-9m88-cf9w https://github.com/baserproject/basercms/security/advisories/GHSA-7rpc-9m88-cf9w
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://github.com/baserproject/basercms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://github.com/baserproject/basercms/commit/9088b99c329d1faff3a2f1269f37b9a9d8d5f6ff
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://github.com/baserproject/basercms/security/advisories/GHSA-7rpc-9m88-cf9w
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41243
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.86382
EPSS Score 0.02799
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:40:36.370867+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/baserproject/basercms/CVE-2021-41243.yml 38.6.0