What is the CVSS score of CVE-2026-30662?

CVE-2026-30662 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-30662?

Organizations using ConcreteCMS v9.4.7 should be aware of notable risk from CVE-2026-30662, a resource exhaustion vulnerability rated CVSS 6.5. Service availability could be impacted.

How to fix or mitigate CVE-2026-30662?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-30662

EUVD-2026-14895 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-03-24 mitre

GHSA-p68c-rmfh-j48h

PHP Denial Of Service

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 14:45 euvd

EUVD-2026-14895

Analysis Generated

Mar 24, 2026 - 14:45 vuln.today

CVE Published

Mar 24, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager component. The 'download' method in 'concrete/controllers/backend/file.php' improperly manages memory when creating zip archives. It uses 'ZipArchive::addFromString' combined with 'file_get_contents', which loads the entire content of every selected file into PHP memory. An authenticated attacker can exploit this by requesting a bulk download of large files, triggering an Out-Of-Memory (OOM) condition that causes the PHP-FPM process to terminate (SIGSEGV) and the web server to return a 500 error.

AnalysisAI

ConcreteCMS version 9.4.7 contains a memory exhaustion vulnerability in the File Manager's download functionality that allows authenticated attackers to trigger a Denial of Service condition. The vulnerability exists in the 'download' method of 'concrete/controllers/backend/file.php', where improper memory management during zip archive creation using ZipArchive::addFromString combined with file_get_contents loads entire file contents into PHP memory without streaming or size validation. An attacker with valid authentication credentials can exploit this by requesting bulk downloads of large files, exhausting available PHP memory and causing the PHP-FPM process to crash with a SIGSEGV signal, rendering the web application unavailable with HTTP 500 errors.

Technical ContextAI

The vulnerability exploits a common PHP memory management antipattern in the ZipArchive class implementation. The vulnerable code path uses file_get_contents to load complete file contents into memory before passing them to ZipArchive::addFromString, bypassing the streaming capabilities that ZipArchive provides through addFile and other methods. This is a classic instance of CWE-400 (Uncontrolled Resource Consumption) or CWE-770 (Allocation of Resources Without Limits or Throttling). ConcreteCMS, a PHP-based content management system, is affected in version 9.4.7. The issue manifests because PHP's default memory_limit configuration is fixed, and the vulnerable code loads all requested files simultaneously rather than processing them incrementally, making it trivial for an authenticated user to allocate more memory than the PHP process can handle.

RemediationAI

Upgrade ConcreteCMS to the latest version that includes a patch for this vulnerability (check the ConcreteCMS project repository for version 9.4.8 or later, or the latest stable release). The primary fix involves refactoring the file download handler to use streaming-based approaches such as ZipArchive::addFile instead of loading file contents into memory via file_get_contents, or implementing chunked reading with explicit memory limits per operation. Until a patch can be deployed, implement the following workarounds: restrict File Manager access to trusted administrators only via role-based access control and disable bulk download functionality if possible via configuration or by modifying the controller temporarily. Additionally, configure PHP memory_limit to a reasonable but not excessive value (e.g., 256MB to 512MB) to limit the impact of any single request, and monitor PHP-FPM error logs for SIGSEGV signals as an early warning of exploitation attempts. Consult the official ConcreteCMS security advisory and release notes for the exact patched version and deployment instructions.