PT-2026-46047 · Unknown · Concrete Cms

Sanjorn Keeratirungsan + 1 · CVE-2026-7888 · Published 2026-06-03 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.2

Description PHP Object Injection occurs due to the use of unserialize() calls within the Workflow, Form block, and File/Set components that do not implement the allowed classes restriction. This allows an unauthenticated attacker to trigger arbitrary PHP object instantiation if a malicious serialized payload is present in the database.

Recommendations Update to version 9.5.2 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-7888

GHSA-52PR-7VMF-2W7X

Affected Products

Concrete Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7888.json · Exploit
• https://osv.dev/vulnerability/GHSA-52pr-7vmf-2w7x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-7888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7888 · Security Note
• https://github.com/concretecms/concretecms/releases/tag/9.5.2 · Note
• https://github.com/concretecms/concretecms · Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes · Note
• https://twitter.com/CVEnew/status/2062404843009147279 · Twitter Post
• https://t.me/CVEtracker/55753 · Telegram Post
• https://t.me/cveNotify/213304 · Telegram Post