Executive brief
Concrete CMS, a content management system used for building and managing websites, is vulnerable to a security flaw that could allow an administrative user to take full control of the server. By exploiting a weakness in how the system handles file paths and uploads, a malicious user with form-editing permissions can execute unauthorized code on the underlying web server. This could lead to a complete compromise of the website, including the theft of sensitive data or a total service outage.
Technical details
Concrete CMS versions 9.5.0 and below contain a relative path traversal vulnerability (CWE-23) within the 'ptComposerFormLayoutSetControlCustomTemplate' field. The application fails to sanitize path traversal sequences when saving page type composer form layouts. An authenticated attacker with administrator-level privileges (specifically composer form editing rights) can exploit this to include arbitrary readable files. Furthermore, because the CMS file uploader performs only extension-based validation, an attacker can upload a PHP payload disguised as an image (e.g., .png) and use the traversal vulnerability to include and execute it, resulting in remote code execution (RCE). This issue is resolved in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed
- 2026-05-21: advisory
- 2026-05-21: patched: Released in version 9.5.1