CVE-2026-3452 Details
Description
Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parameter. An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to unserialize() without class restrictions or integrity checks. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks YJK ( @YJK0805 https://hackerone.com/yjk0805 ) of ZUSO ART https://zuso.ai/ for reporting.
A remote code execution vulnerability has been identified in Concrete CMS versions prior to 9.4.8. This issue arises from stored PHP object injection into the Express Entry List block, specifically through the columns parameter. An authenticated administrator can inject serialized data into block configuration fields, which is later unserialized without any class restrictions or integrity checks. This flaw allows for the execution of arbitrary code on the server.
Users can upgrade to Concrete CMS version 9.4.8 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes | ConcreteCMS | PatchRelease NotesVendor Advisory |
| https://github.com/concretecms/concretecms/pull/12826/changes/167f16e4805d8ab546d2997c753ac21bf4854920:// | ConcreteCMS | Broken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | ConcreteCMS |
Affected Products
| Product | Versions |
|---|---|
| concretecms concrete cms | < 9.4.8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | ConcreteCMS |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 4, 2026 | Initial Analysis | [email protected] |
| Mar 4, 2026 | New CVE Received | ConcreteCMS |