What is CVE-2026-97150?

CVE-2026-97150 is a high-severity vulnerability in Basercms Users Community Bcaddonmigrator, classified under Inclusion of Functionality from Untrusted Control Sphere. CVSS score: 7.2/10. Published 2026-09-30.

How severe is CVE-2026-97150?

High severity. CVSS v3 base score is 7.2 out of 10.

Vulnerability in Basercms Users Community Bcaddonmigrator

CVE-2026-97150

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

Published 2026-09-30.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Basercms Users Community Bcaddonmigrator

Weakness classification (CWE)

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere

References

Frequently asked questions

What is CVE-2026-97150?: CVE-2026-97150 is a high-severity vulnerability in Basercms Users Community Bcaddonmigrator, classified under Inclusion of Functionality from Untrusted Control Sphere. CVSS score: 7.2/10. Published 2026-09-30.
How severe is CVE-2026-97150?: High severity. CVSS v3 base score is 7.2 out of 10.