GitHub Advisoryadvisory · Packagist

GHSA-g82f-9pw7-773w Concrete CMS: PHP Object Injection via unserialize() calls

HIGH Published 2026-06-10 Modified 2026-08-12 Official page ↗
Aliases
CVE-2026-10721
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
High
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-502
Reviewed
2026-08-12

Affected packages

• Packagist concrete5/concrete5: < 9.5.2 → fixed in 9.5.2

Description

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Concrete CMS thanks XananasX7 for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-10721 Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References