---
id: CVE-2026-115479
title: 'baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients'
summary: >-
  baserCMS is a website development framework. In versions 5.2.5 before 5.3.2
  and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a
  comma-separated address list in a public mail form's email field and cause a
  single auto-reply to…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-20
vendor: baserproject
product: basercms
affected:
  - 'basercms >= 5.2.5, < 5.3.2'
  - 'basercms >= 5.4.0, < 5.4.2'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T13:36:01.655Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115479'
references:
  - url: >-
      https://github.com/baserproject/basercms/security/advisories/GHSA-w47c-4g8m-gjv9
    label: >-
      https://github.com/baserproject/basercms/security/advisories/GHSA-w47c-4g8m-gjv9
  - url: >-
      https://github.com/baserproject/basercms/commit/99e6257c9d5e2fa2bff2351defcb9fb37f69daf1
    label: >-
      https://github.com/baserproject/basercms/commit/99e6257c9d5e2fa2bff2351defcb9fb37f69daf1
  - url: 'https://github.com/baserproject/basercms/releases/tag/5.3.2'
    label: 'https://github.com/baserproject/basercms/releases/tag/5.3.2'
  - url: 'https://github.com/baserproject/basercms/releases/tag/5.4.2'
    label: 'https://github.com/baserproject/basercms/releases/tag/5.4.2'
tags:
  - cve.org
ingestedAt: '2026-10-23T14:28:08.704Z'
---

## Overview

baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties. MailMessageMailer::sendFormToUser() passes the visitor-controlled userMail value to parseAndNormalizeMailAddresses(), which splits it with explode(',') and supplies every resulting address to setTo(). Newly created forms with an email-type field are affected when the separate, optional VALID_EMAIL server-side validation is not enabled; browser type=email validation does not prevent crafted requests. The bundled contact form enables VALID_EMAIL and is not affected. The auto-reply uses the site's sender identity and includes partially attacker-controlled content, allowing abuse of the site to deliver unsolicited mail. This issue has been patched in versions 5.3.2 and 5.4.2.

## Affected

- `basercms >= 5.2.5, < 5.3.2`
- `basercms >= 5.4.0, < 5.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.