CVE-2026-8134 Details
Description
Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader's extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code execution. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 9.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Thanks Yonatan Drori (Tenzai) for reporting.
A vulnerability in Concrete CMS versions through 9.5.0 allows for path traversal attacks via the ptComposerFormLayoutSetControlCustomTemplate field. This issue arises when saving page type composer form layouts, as the application fails to properly sanitize traversal sequences. An authenticated rogue administrator with rights to edit composer forms can exploit this flaw to include arbitrary readable files from the server. Furthermore, this vulnerability can be combined with the file uploader's extension-only validation, which mistakenly allows PHP code to be executed in files saved with image extensions like .png. This could result in authenticated remote code execution.
Users can upgrade to Concrete CMS version 9.5.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes | ConcreteCMS | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-23 | Relative Path Traversal | ConcreteCMS |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | ConcreteCMS |
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | ConcreteCMS |
Affected Products
| Product | Versions |
|---|---|
| concretecms concrete cms | <= 9.5.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | ConcreteCMS |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | Initial Analysis | [email protected] |
| May 21, 2026 | New CVE Received | ConcreteCMS |