CVE-2026-7888

Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. The Form block and File/Set sinks were addressed in 9.5.2; the Workflow component sinks were addressed in 9.5.3. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 and Sanjorn Keeratirungsan (dizconnect) for independently reporting the original components, and sh4d0byss for reporting the Workflow component wasn't fixed in 9.5.2. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.4 with vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/ VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

CVSS

No CVSS.

References

Link	Resource
https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-03 19:16

Updated : 2026-09-11 20:18

NVD link : CVE-2026-7888

Mitre link : CVE-2026-7888

CVE.ORG link : CVE-2026-7888

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-7888", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7888", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-03T19:07:44.886735Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "affectedData": [{"repo": "https://github.com/concretecms/concretecms", "vendor": "Concrete CMS", "product": "Concrete CMS", "versions": [{"status": "affected", "version": "5.0", "versionType": "git", "lessThanOrEqual": "9.5.2"}], "collectionURL": "https://github.com/concretecms/concretecms", "defaultStatus": "unaffected"}]}], "published": "2026-06-03T19:16:38.910", "references": [{"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes", "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize()\ncalls in the Workflow, Form block, and File/Set components that lack the\nallowed_classes restriction. The Form block and File/Set sinks were addressed in\n9.5.2; the Workflow component sinks were addressed in 9.5.3. An unauthenticated\nattacker may trigger arbitrary PHP object instantiation if a malicious serialized\npayload has been placed in the database. Thanks XananasX7 and Sanjorn Keeratirungsan\n(dizconnect) for independently reporting the original components, and sh4d0byss for\nreporting the Workflow component wasn't fixed in 9.5.2. The Concrete CMS security team gave this\nvulnerability a CVSS v.4.0 score of 8.4 with vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/\nVC:H/VI:H/VA:H/SC:N/SI:N/SA:N."}, {"lang": "es", "value": "Concrete CMS anterior a 9.5.2 es vulnerable a la Inyecci\u00f3n de objetos PHP a trav\u00e9s de llamadas a unserialize() en los componentes Workflow, Form block y File/Set que carecen de la restricci\u00f3n allowed_classes. Un atacante no autenticado puede desencadenar la instanciaci\u00f3n arbitraria de objetos PHP si se ha colocado una carga \u00fatil serializada maliciosa en la base de datos. Gracias a XananasX7 y Sanjorn Keeratirungsan (dizconnect) por informar ambos de forma independiente. El equipo de seguridad de Concrete CMS otorg\u00f3 a esta vulnerabilidad una puntuaci\u00f3n CVSS v.4.0 de 8.4 con el vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N."}], "lastModified": "2026-09-11T20:18:54.320", "sourceIdentifier": "ff5b8ace-8b95-4078-9743-eac1ca5451de"}