Executive brief
Concrete CMS, a popular content management system, is vulnerable to a security flaw in how it handles certain data related to forms, workflows, and file sets. An attacker who has already gained high-level access to the system could use this flaw to execute unauthorized code or take full control of the server. This could lead to a total loss of data confidentiality and system availability.
Technical details
Concrete CMS versions prior to 9.5.2 contain a PHP Object Injection vulnerability (CWE-502) due to the insecure use of the unserialize() function. The affected components—Workflow, Form block, and File/Set—fail to implement the 'allowed_classes' restriction, allowing for the instantiation of arbitrary PHP objects. While the attack vector is listed as local with high privileges required in CVSS metrics, the advisory notes that an unauthenticated attacker could trigger the injection if a malicious serialized payload is successfully placed in the database. Successful exploitation can lead to remote code execution depending on available gadget chains. The issue is resolved in version 9.5.2.
Affected products
- Concrete CMS Concrete CMS < 9.5.2
Timeline
- 2026-06-03: advisory: GitHub Advisory and NVD entry published
- 2026-06-03: patched: Version 9.5.2 released