CVE-2026-3452

HIGH EPSS 44.5%
Published Mar 4, 20263mo ago · Modified Jun 17, 20262w ago
8.9 CVSS 4.0
High
Find Similar
Published Mar 4, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parameter. An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to unserialize() without class restrictions or integrity checks. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks YJK ( @YJK0805 https://hackerone.com/yjk0805 ) of ZUSO ART https://zuso.ai/  for reporting.

CVSS Details

Base Score
8.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required High
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
44.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-502 Deserialization of Untrusted Data Validation

Affected Products 1

VendorProductVersionRange
concretecmsconcrete_cms* <9.4.8

References 2

  • documentation.concretecms.org https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes
    PatchRelease NotesVendor Advisory
  • github.com https://github.com/concretecms/concretecms/pull/12826/changes/167f16e4805d8ab546d2997c753ac21bf4854920://
    Broken Link

Remediation

  • documentation.concretecms.org https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes
    PatchRelease NotesVendor Advisory