CVE-2026-7888: Concrete CMS PHP Object Injection Vulnerability in Workflow, Form Block, and File/Set Components
Summary
CVE-2026-7888: Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. Affects concrete5/concrete5 versions < 9.5.2. Fixed in 9.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system (CMS) designed for building and managing websites. It offers a user-friendly interface, customizable themes, and a variety of add-ons to enhance functionality. However, versions prior to 9.5.2 are susceptible to a critical vulnerability that allows PHP Object Injection through insecure unserialize() calls in specific components, potentially compromising the integrity of the application.
Vulnerability Detail
Concrete CMS versions below 9.5.2 are vulnerable to PHP Object Injection due to the lack of the allowed_classes restriction in unserialize() calls within the Workflow, Form block, and File/Set components. An unauthenticated attacker can exploit this vulnerability by injecting a malicious serialized payload into the database, leading to arbitrary PHP object instantiation. This could allow attackers to execute arbitrary code, manipulate data, or gain unauthorized access to sensitive information, posing a significant risk to the application and its users.
How To Fix
Minimum fixed version
9.5.2
This is the first release that contains the fix.
composer require concrete5/concrete5:9.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the affected components and validate any serialized data before processing it. However, the best course of action is to update to the latest version as soon as possible.
Conclusion
The vulnerability identified as CVE-2026-7888 poses a significant risk to Concrete CMS installations prior to version 9.5.2 due to PHP Object Injection vulnerabilities. It is crucial for users to update to the latest version to mitigate this risk and protect their applications from potential exploitation.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
PHP Object Injection is a vulnerability that occurs when an application unserializes untrusted data, allowing attackers to instantiate arbitrary objects and potentially execute malicious code.
If you are using a version of Concrete CMS prior to 9.5.2, your installation is vulnerable. You can check your version in the admin dashboard or by inspecting the composer.lock file.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and execution of arbitrary code, which can severely compromise the security of your application.
Yes, you can use tools like Vulert, which monitors your composer.lock file for open-source vulnerabilities in real-time. You can also check your application against known vulnerabilities using the Vulert playground.
The CVSS score for this vulnerability is 8.4, indicating a high severity level that requires immediate attention.
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
