Published:2026/09/25  Last Updated:2026/09/25

JVN#21754394
baserCMS plugin "BcAddonMigrator" vulnerable to inclusion of functionality from untrusted control sphere

Overview

baserCMS plugin "BcAddonMigrator" provided by baserCMS Users Community contains a vulnerability due to inclusion of functionality from untrusted control sphere.

Products Affected

  • BcAddonMigrator 5.2.0 and earlier

Description

baserCMS plugin "BcAddonMigrator" provided by baserCMS Users Community contains the following vulnerability.

  • Inclusion of Functionality from Untrusted Control Sphere (CWE-829)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.6
    • CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2
    • CVE-2026-97150

Impact

Arbitrary files on the system may be read or deleted by an attacker who can log in to the product with an administrative privilege.

Solution

Update the plugin
Update the plugin to the latest version according to the information provided by the developer.
The developer has released the following version that addresses this vulnerability.

  • BcAddonMigrator 5.2.1

Vendor Status

Vendor Status Last Update Vendor Notes
baserCMS Users Community Vulnerable 2026/09/25 baserCMS Users Community website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Kuniyoshi Noguchi (KuniNogu) of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-97150
JVN iPedia JVNDB-2026-000138