JVNVU94952030
BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability.
BaserCMS versions prior to 5.3.0
BaserCMS provided by baserCMS Users Community contains the following vulnerability. Improper neutralization of formula elements in a CSV file ( CWE-1236 ) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L Base Score 5.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Base Score 7.1 CVE-2026-65875
If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.
Update the Software Update the software to the latest version according to the information provided by the developer.
This vulnerability was reported by the following persons to JPCERT/CC. JPCERT/CC coordinated with the developer. VCSLab - Viettel Cyber Security quanlna2 (Le Nguyen Anh Quan) VCSLab - Viettel Cyber Security namdi (Do Ich Nam) VCSLab - Viettel Cyber Security minhnn42 (Nguyen Ngoc Minh)
JPCERT Alert JPCERT Reports CERT Advisory CPNI Advisory TRnotes CVE CVE-2026-65875 JVN iPedia
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
