PT-2026-27435 · Unknown · Concrete Cms

Wang1Rrr · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-30662

Positive Technologies · (AI Summary)

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ConcreteCMS version 9.4.7

Description The File Manager component in ConcreteCMS version 9.4.7 has a flaw that can lead to a Denial of Service (DoS). The 'download' method within 'concrete/controllers/backend/file.php' does not efficiently handle memory usage when generating zip archives. Specifically, the combination of ZipArchive::addFromString and file get contents results in loading the complete content of each selected file into PHP memory. An authenticated attacker can trigger this issue by requesting a download of numerous large files, potentially causing an Out-Of-Memory (OOM) error, terminating the PHP-FPM process (SIGSEGV), and resulting in a 500 error from the web server.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, limit the number of files that can be selected for bulk download. Consider increasing the PHP memory limit if feasible, but note that this may only delay the issue rather than resolve it.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-30662

Affected Products

Concrete Cms

References · 3

• 🔥 https://wang1rrr.github.io/2026/02/11/CVE-Report-ConcreteCMS-DoS · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30662 · Security Note
• https://twitter.com/VulmonFeeds/status/2036503377517961710 · Twitter Post