Which versions of Concrete CMS are affected by CVE-2026-7888?

Concrete CMS versions prior to 9.5.2 contain a high-severity code execution vulnerability (CVE-2026-7888) that could allow attackers with compromised administrator credentials to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-7888?

24 hours: Inventory all Concrete CMS deployments and identify versions below 9.5.2; restrict administrative access to workflow, form block, and file/set management to essential personnel only. 7 days: Deploy Concrete CMS 9.5.2 or later across all affected systems and conduct functional regression testing in staging. 30 days: Confirm complete deployment; audit administrator activity logs for database modifications; implement multi-factor authentication for CMS administrative accounts.

Concrete CMS CVE-2026-7888

Q: What is the CVSS score of CVE-2026-7888?

CVE-2026-7888 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34164 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-03 ConcreteCMS

GHSA-52pr-7vmf-2w7x

PHP Deserialization Concrete Cms

8.4

CVSS 4.0 · Vendor: ConcreteCMS

Severity by source

Vendor (ConcreteCMS) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ConcreteCMS) · only source for this CVE.

CVSS VectorVendor: ConcreteCMS

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 21:20 vuln.today

Patch available

Jun 03, 2026 - 20:01 EUVD

CVSS changed

Jun 03, 2026 - 19:22 NVD

8.4 (HIGH)

CVE Published

Jun 03, 2026 - 18:10 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 and Sanjorn Keeratirungsan (dizconnect) for both independently reporting. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.4 with vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

AnalysisAI

PHP object injection in Concrete CMS versions below 9.5.2 allows authenticated high-privileged attackers to trigger arbitrary PHP object instantiation through unsafe unserialize() calls in the Workflow, Form block, and File/Set components. The vulnerability requires a malicious serialized payload to be placed in the database beforehand, and no public exploit identified at time of analysis. The vendor scored this 8.4 (CVSS 4.0), and CISA SSVC indicates no observed exploitation but total technical impact if successfully chained.

Technical ContextAI

The flaw is a classic CWE-502 (Deserialization of Untrusted Data) issue rooted in PHP's unserialize() function being called without the allowed_classes parameter introduced in PHP 7. When allowed_classes is omitted or set to true, PHP will instantiate any class referenced in the serialized stream and invoke magic methods like __wakeup() and __destruct(), enabling POP (Property-Oriented Programming) gadget chains. The affected CPE cpe:2.3:a:concrete_cms:concrete_cms covers the Workflow engine, Form block module, and File/Set components of Concrete CMS - each of which deserializes data retrieved from the database without restricting permitted class types, turning any attacker-controlled DB row into a code-execution primitive if a suitable gadget chain exists in the loaded codebase or dependencies.

RemediationAI

Vendor-released patch: upgrade to Concrete CMS 9.5.2 or later, which adds the allowed_classes restriction to the affected unserialize() call sites; release notes are at https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes. Where immediate upgrade is not possible, restrict administrative and editorial access to the Workflow, Form block, and File/Set management interfaces to a minimal set of trusted users to reduce the attack surface for planting malicious serialized payloads (trade-off: workflow/forms editing workflows become more constrained), audit the database tables backing these components for unexpected serialized object strings (look for the 'O:' object marker), and disable unused PHP classes via disable_classes in php.ini to shrink the available gadget surface (trade-off: may break plugins relying on those classes).