PT-2026-22863 · Unknown · Concrete Cms

Yjkofzuso Art · Published 2026-03-04 · Updated 2026-03-04 · CVE-2026-3452

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.4.8

Description Concrete CMS is susceptible to Remote Code Execution due to stored PHP object injection within the Express Entry List block, specifically through the columns parameter. An authenticated administrator can store malicious serialized data in block configuration fields. This data is subsequently processed by the unserialize() function without adequate class restrictions or integrity checks, allowing for potential code execution. The issue involves stored deserialization, which can lead to Remote Code Execution (RCE).

Recommendations Versions prior to 9.4.8 should be updated to version 9.4.8 or later.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-3452

GHSA-GJ26-W59C-29MF

Affected Products

Concrete Cms

References · 14

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3452 · Security Note
• https://osv.dev/vulnerability/GHSA-gj26-w59c-29mf · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://github.com/concretecms/concretecms/pull/12826/changes/167f16e4805d8ab546d2997c753ac21bf4854920 · Note
• https://twitter.com/VulmonFeeds/status/2029036859423142187 · Twitter Post
• https://t.me/CVEtracker/46272 · Telegram Post
• https://t.me/cveNotify/154225 · Telegram Post
• https://twitter.com/CVEarity/status/2029168346730774978 · Twitter Post
• https://twitter.com/infoflowcloud/status/2029040560627937649 · Twitter Post
• https://twitter.com/CVEnew/status/2029039194572517618 · Twitter Post
• https://github.com/concretecms/concretecms/pull/12826/changes/167f16e4805d8ab546d2997c753ac21bf4854920: · Note
• https://twitter.com/cyberbivash/status/2029061302807630232 · Twitter Post