PT-2026-48390 · Concrete Cms · Concrete Cms

Xananasx7 · Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-10721

NVD

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 for reporting.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-10721

Affected Products

Concrete Cms

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-10721 · Security Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes · Note