CVE-2026-3452 json
Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.
published 2026-03-04 8 mo ago modified 2026-06-17 4 mo ago also GHSA-gj26-w59c-29mf , EUVD-2026-9356
- cvss
- 7.2
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parameter. An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to unserialize() without class restrictions or integrity checks. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks YJK ( @YJK0805 https://hackerone.com/yjk0805 ) of ZUSO ART https://zuso.ai/ for reporting.
Patch / fix
- packagist concrete5/concrete5 9.4.8
- concretecms concrete_cms 9.4.8
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction
0.69% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.9 | CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 4.0 | 8.9 | CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | concrete5/concrete5 | <9.4.8 |
9.4.8 |
Affected products
- Concrete CMS Concrete CMS
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/concretecms/concretecms/pull/12826/changes/167f16e4805d8ab546d2997c753ac21bf4854920://
broken-link
-
documentation.concretecms.org
/9-x/developers/introduction/version-history/948-release-notes
web, patch, release-notes, vendor-advisory
-
github.com
/concretecms/concretecms/pull/12826/changes/167f16e4805d8ab546d2997c753ac21bf4854920
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-3452
advisory
-
github.com
/concretecms/concretecms
package
Sources
- CVE List CVE-2026-3452
- GitHub Advisory GHSA-gj26-w59c-29mf
- NVD CVE-2026-3452
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.