Security Digest: March 31, 2026 - 9 Critical Vulnerabilities

Today, nine critical vulnerabilities have been identified across various platforms, with potential for remote code execution, unauthorized access, and data exposure.

· 5 min read

Executive Summary

Today, nine critical vulnerabilities have been identified across various platforms, with potential for remote code execution, unauthorized access, and data exposure. Immediate patching and compliance with recommended mitigations are crucial to safeguard systems.

Critical Vulnerabilities

  • CVE-2026-21861: Remote Code Execution in baserCMS
    • Impact: Allows RCE with administrator privileges.
    • Affected Systems: baserCMS 5.2.2
    • Immediate Action: Disable core update functionality. Apply input validation patches.
    • Mitigation: Fix PHP executable path using escapeshellarg(PHP_BINARY).
  • CVE-2026-30877: OS Command Injection in baserCMS
    • Impact: Execute OS commands with administrator privileges.
    • Affected Systems: baserCMS 5.2.2
    • Immediate Action: Restrict admin access and update the affected components.
    • Mitigation: Implement command input validation.
  • CVE-2026-25726: Weak PRNG in Cloudreve
    • Impact: Allows JWT forgery and privilege escalation.
    • Affected Systems: Cloudreve versions before 4.13.0
    • Immediate Action: Upgrade to version 4.13.0.
    • Mitigation: Manually rotate critical secrets if upgrade is delayed.
  • CVE-2026-32716: Authorization Bypass in SciTokens
    • Impact: Unauthorized access to sibling paths.
    • Affected Systems: SciTokens library
    • Immediate Action: Apply patches to fix scope validation logic.
    • Mitigation: Review and correct scope path validation.
  • CVE-2026-32727: Path Traversal in SciTokens
    • Impact: Directory traversal leading to unauthorized access.
    • Affected Systems: SciTokens library
    • Immediate Action: Ensure scope does not contain .. components before normalization.
    • Mitigation: Implement input sanitization and validation.
  • CVE-2026-34240: JWS/JWT Forgery in JOSE
    • Impact: Allows token forgery via untrusted keys.
    • Affected Systems: JOSE library up to 0.3.5
    • Immediate Action: Upgrade to 0.3.5+1 or later.
    • Mitigation: Reject tokens containing untrusted jwk.
  • CVE-2026-34381: Unauthorized File Access in Admidio
    • Impact: Direct access to uploaded files without authentication.
    • Affected Systems: Admidio Docker image
    • Immediate Action: Modify Apache config to enable AllowOverride.
    • Mitigation: Store uploads outside web root.
  • CVE-2026-30940: Path Traversal in baserCMS Theme API
    • Impact: Arbitrary file write leading to RCE.
    • Affected Systems: baserCMS 5.x
    • Immediate Action: Disable public API access and sanitize path inputs.
    • Mitigation: Use realpath() to verify paths.
  • CVE-2026-32734: XSS in baserCMS Tag Creation
    • Impact: Execute malicious scripts via tag creation.
    • Affected Systems: baserCMS 5.2.2 and earlier
    • Immediate Action: Update to the latest version of baserCMS.
    • Mitigation: Filter inputs for script tags.

Previously Alerted

What to Do Now

  1. Immediately apply available patches and updates.
  2. Disable vulnerable functionalities where patches are unavailable.
  3. Enhance monitoring for unusual activities related to these vulnerabilities.

Related Resources

  • Check official vendor advisories for detailed patch instructions.
  • Stay updated with our internal blog posts for ongoing coverage.

Keep reading