GitHub Advisoryadvisory · Packagist

GHSA-645j-cm4x-3xvw Concrete CMS Vulnerable to Relative Path Traversal

CRITICAL Published 2026-05-21 Modified 2026-06-23 Official page ↗
Aliases
CVE-2026-8134
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-23
Reviewed
2026-06-23

Affected packages

• Packagist concrete5/concrete5: < 9.5.1 → fixed in 9.5.1

Description

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader's extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code execution. Concrete CMS thanks Yonatan Drori (Tenzai) for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-8134 Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when… vulnerability

Weakness · CWE (1)

  • CWE-23 Relative Path Traversal weakness

References