# CVE-2026-10721: Concrete CMS PHP object injection in Permission Cache and Search components

Source: https://junglewise.ai/threats/cve-2026-10721-concrete-cms-php-object-injection-in-permission-cache-and-search  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-10721 · Severity: high · CVSS 4 · Published 2026-06-10

Concrete CMS, a content management system used for building and managing websites, is vulnerable to a security flaw in its Permission, Cache, and Search components. If an attacker can place malicious data into the website's database, they can force the system to execute unintended code. This could lead to a complete takeover of the website, unauthorized access to sensitive data, or service disruption.

Technologies: [Concrete CMS](https://junglewise.ai/threats/technologies/concrete-cms), [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5). Vendors: [Concrete CMS](https://junglewise.ai/threats/vendors/concrete-cms), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-10721 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10721 being exploited in the wild.

**How severe is CVE-2026-10721?** High severity, with a CVSS score of 4, published 10 June 2026.

**Which products and versions are affected?** Concrete CMS < 9.5.2; concrete5/concrete5 (Packagist) < 9.5.2, ECOSYSTEM:introduced=0,fixed=9.5.2.

**Is there a fix for CVE-2026-10721?** Yes. concrete5/concrete5 (Packagist): upgrade to 9.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10721 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-10721?** Check whether you run Concrete CMS or concrete5/concrete5 (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- concrete5/concrete5 (Packagist): upgrade to 9.5.2 or later

  ```sh
  composer require concrete5/concrete5:^9.5.2
  ```


## Technical details

Concrete CMS versions prior to 9.5.2 are vulnerable to PHP Object Injection (CWE-502) due to the insecure use of the PHP unserialize() function without restricting allowed classes. The vulnerability exists within the Permission, Cache, and Search components. An attacker with the ability to inject a malicious serialized payload into the database (requiring high privileges or a separate vulnerability) can trigger arbitrary PHP object instantiation when the system subsequently processes that data. This can lead to remote code execution depending on the available gadget chains. The issue is mitigated in version 9.5.2 by implementing the 'allowed_classes' option in unserialize() calls.

## Affected products

- Concrete CMS Concrete CMS < 9.5.2

## Identifiers

- CVE-2026-10721
- GHSA-g82f-9pw7-773w

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-08-12: patched: Advisory updated to reflect patch in 9.5.2

## References

- [https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes](https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes)

## Related threats

- [Concrete CMS OAuth REST API authorization bypass](https://junglewise.ai/threats/cve-2026-85387-concrete-cms-oauth-rest-api-authorization-bypass)
- [Concrete CMS unauthenticated Express entry search disclosure](https://junglewise.ai/threats/cve-2026-18120-concrete-cms-unauthenticated-express-entry-search-disclosure)
- [Concrete CMS REST API user creation permission bypass](https://junglewise.ai/threats/cve-2026-87031-concrete-cms-rest-api-user-creation-permission-bypass)
- [Concrete CMS access control bypass in board custom-slot preview](https://junglewise.ai/threats/cve-2026-87028-concrete-cms-access-control-bypass-in-board-custom-slot-preview)
- [Concrete CMS stored XSS via XML file upload in Form Block](https://junglewise.ai/threats/cve-2026-85386-concrete-cms-stored-xss-via-xml-file-upload-in-form-block)