PT-2026-46047 · Concrete Cms · Concrete Cms

Sanjorn Keeratirungsan + 1 · Published 2026-06-03 · Updated 2026-06-03 · CVE-2026-7888

Mitre

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed classes restriction. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 and Sanjorn Keeratirungsan (dizconnect) for both independently reporting. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.4 with vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-7888

Affected Products

Concrete Cms

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-7888 · Security Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes · Note