CVE-2026-7888 Details
Description
Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. The Form block and File/Set sinks were addressed in 9.5.2; the Workflow component sinks were addressed in 9.5.3. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 and Sanjorn Keeratirungsan (dizconnect) for independently reporting the original components, and sh4d0byss for reporting the Workflow component wasn't fixed in 9.5.2. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.4 with vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/ VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
A PHP Object Injection vulnerability has been identified in Concrete CMS versions prior to 9.5.2. The issue arises from unserialize() calls in the Workflow, Form block, and File/Set components, which do not restrict allowed classes. This vulnerability allows an unauthenticated attacker to trigger arbitrary PHP object instantiation by placing a malicious serialized payload in the database.
Users can upgrade to Concrete CMS version 9.5.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 3, 2026CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes | ConcreteCMS | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | ConcreteCMS |
Affected Products
| Product | Versions |
|---|---|
| Concrete CMS | < 9.5.2 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | ConcreteCMS |
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | ConcreteCMS |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | New CVE Received | ConcreteCMS |