What’s Vulnerable › Vulnerabilities

CVE-2026-3452: Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-04 · updated 2026-06-17
• Weakness: CWE-502

Description

Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parameter. An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to unserialize() without class restrictions or integrity checks. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks YJK ( @YJK0805 https://hackerone.com/yjk0805 ) of ZUSO ART https://zuso.ai/  for reporting.

Affected products

• Concrete CMS: before 9.4.8 — fixed in 9.4.8

How to fix

Upgrade to a fixed version: Concrete CMS 9.4.8. Check the vendor advisory for mitigations.

References

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes
• https://github.com/concretecms/concretecms/pull/12826/changes/167f16e4805d8ab546d2997c753ac21bf4854920://

Get alerted when CVE-2026-3452 or the next vulnerability affects your stack