Summary
A path traversal vulnerability in baserCMS's optional BcThemeFile plugin allows an authenticated administrator to write files outside the intended theme directory. When percent-encoded traversal is decoded after path validation, an attacker may place PHP files in writable web-accessible locations and execute them.
A path traversal vulnerability in baserCMS's optional BcThemeFile plugin allows an authenticated administrator to write files outside the intended theme directory. When percent-encoded traversal is decoded after path validation, an attacker may place PHP files in writable web-accessible locations and execute them.
Affected context
The issue occurs in baserCMS deployments where the optional BcThemeFile plugin is enabled and its Admin API processes theme-file paths. The vulnerable flow validates a raw path, then decodes it before writing, allowing encoded traversal to bypass containment checks. The Admin web form is not affected in the same way because FormProtection covers the fullpath value.
The issue occurs in baserCMS deployments where the optional BcThemeFile plugin is enabled and its Admin API processes theme-file paths. The vulnerable flow validates a raw path, then decodes it before writing, allowing encoded traversal to bypass containment checks. The Admin web form is not affected in the same way because FormProtection covers the fullpath value.
Exploit preconditions
- Attack surface: The authenticated Admin API provided by the optional BcThemeFile plugin
- Required access: A valid administrator session with permission to use the theme-file functionality
- Request conditions: A same-origin
Originheader is required for the relevant request flow - Trigger point: Theme file update processing in
ThemeFileForm::_execute() - Why exploitation is possible: Path containment is checked before
rawurldecode()transforms an encoded traversal sequence into directory traversal - Deployment condition: The target must have writable locations outside the intended theme directory, such as a webroot
- Attack surface: The authenticated Admin API provided by the optional BcThemeFile plugin
- Required access: A valid administrator session with permission to use the theme-file functionality
- Request conditions: A same-origin
Originheader is required for the relevant request flow - Trigger point: Theme file update processing in
ThemeFileForm::_execute() - Why exploitation is possible: Path containment is checked before
rawurldecode()transforms an encoded traversal sequence into directory traversal - Deployment condition: The target must have writable locations outside the intended theme directory, such as a webroot
Why this happens
The underlying bug is a check-before-decode ordering flaw. ThemeFilesService::update() and getFullpath() validate a raw path and use normalization that resolves only literal dot segments, while ThemeFileForm::_execute() later applies rawurldecode() before writing the file. Encoded traversal therefore remains hidden during validation but becomes active at the write sink. This maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with CWE-180: Incorrect Behavior Order describing the unsafe transformation sequence. A similar ordering pattern is identified in the copy path, although that path was not dynamically verified.
The underlying bug is a check-before-decode ordering flaw. ThemeFilesService::update() and getFullpath() validate a raw path and use normalization that resolves only literal dot segments, while ThemeFileForm::_execute() later applies rawurldecode() before writing the file. Encoded traversal therefore remains hidden during validation but becomes active at the write sink. This maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with CWE-180: Incorrect Behavior Order describing the unsafe transformation sequence. A similar ordering pattern is identified in the copy path, although that path was not dynamically verified.
Potential impact
- An attacker may write PHP or other executable files outside the intended theme directory.
- Web-accessible file placement could enable remote code execution under the application's runtime identity.
- The application may be modified, defaced, or used to distribute malicious content.
- Sensitive data accessible to the application account could be exposed or altered.
- A compromised application process could facilitate further compromise, depending on its privileges and environment.
- An attacker may write PHP or other executable files outside the intended theme directory.
- Web-accessible file placement could enable remote code execution under the application's runtime identity.
- The application may be modified, defaced, or used to distribute malicious content.
- Sensitive data accessible to the application account could be exposed or altered.
- A compromised application process could facilitate further compromise, depending on its privileges and environment.
General mitigation guidance
Mitigation focuses on enforcing directory containment after every decoding and normalization step, immediately before file access.
Common defensive patterns include:
- Decode and canonicalize path input before validation rather than validating an earlier representation.
- Reject encoded separators, traversal components, null bytes, and ambiguous path forms unless they are explicitly required.
- Resolve the final target path and verify that it remains beneath the approved theme directory.
- Prefer opaque file identifiers or allowlisted relative filenames over user-controlled filesystem paths.
- Apply the same validation model consistently to update, read, copy, and delete operations.
- Restrict theme-file write permissions and prevent writable webroots from serving newly created executable files where practical.
- Run the application with least privilege and separate content-editing capabilities from operating-system-level permissions.
- Preserve request-integrity protections for administrative interfaces, while treating them as complementary controls rather than path validation.
Mitigation focuses on enforcing directory containment after every decoding and normalization step, immediately before file access.
Common defensive patterns include:
- Decode and canonicalize path input before validation rather than validating an earlier representation.
- Reject encoded separators, traversal components, null bytes, and ambiguous path forms unless they are explicitly required.
- Resolve the final target path and verify that it remains beneath the approved theme directory.
- Prefer opaque file identifiers or allowlisted relative filenames over user-controlled filesystem paths.
- Apply the same validation model consistently to update, read, copy, and delete operations.
- Restrict theme-file write permissions and prevent writable webroots from serving newly created executable files where practical.
- Run the application with least privilege and separate content-editing capabilities from operating-system-level permissions.
- Preserve request-integrity protections for administrative interfaces, while treating them as complementary controls rather than path validation.
How teams detect issues like this
Detection can combine source review, automated analysis, and runtime monitoring:
- Search for path validation or containment checks that occur before URL decoding, Unicode normalization, archive extraction, or other input transformations.
- Review filesystem APIs receiving values that have passed through
rawurldecode(), URL decoding, or equivalent routines. - Flag concatenation of request-controlled paths with trusted directories without final canonical containment checks.
- Test administrative file-management endpoints with encoded traversal representations in controlled security assessments.
- Monitor webroot and other application directories for unexpected PHP files or modifications by the application service account.
- Enforce code-review policies requiring canonicalization and allowlist checks at the final file-operation boundary.
- Use static-analysis and software-composition or application-security testing tools that identify path traversal and unsafe path normalization patterns.
Detection can combine source review, automated analysis, and runtime monitoring:
- Search for path validation or containment checks that occur before URL decoding, Unicode normalization, archive extraction, or other input transformations.
- Review filesystem APIs receiving values that have passed through
rawurldecode(), URL decoding, or equivalent routines. - Flag concatenation of request-controlled paths with trusted directories without final canonical containment checks.
- Test administrative file-management endpoints with encoded traversal representations in controlled security assessments.
- Monitor webroot and other application directories for unexpected PHP files or modifications by the application service account.
- Enforce code-review policies requiring canonicalization and allowlist checks at the final file-operation boundary.
- Use static-analysis and software-composition or application-security testing tools that identify path traversal and unsafe path normalization patterns.
