Which versions of Concrete CMS are affected by CVE-2026-8134?

Concrete CMS versions 9.5.0 and earlier contain a critical vulnerability allowing authenticated administrators with form editing privileges to execute arbitrary code and gain complete control over…. A patch is available.

How to fix or mitigate CVE-2026-8134?

Within 24 hours: Inventory all Concrete CMS deployments and determine which run versions 9.5.0 or earlier; immediately audit and restrict composer form editing privileges to only essential administrators. Within 7 days: Implement compensating controls (detailed below), enable enhanced logging of administrative form editing and upload activities, and brief security team on indicators of exploitation. Within 30 days: Monitor vendor advisories for patch release; plan and execute upgrade to patched versions when available, or initiate migration strategy if timely patching is not feasible.

Concrete CMS CVE-2026-8134

Q: What is the CVSS score of CVE-2026-8134?

CVE-2026-8134 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-31335 CRITICAL

PHP Remote File Inclusion (CWE-98)

2026-05-21 ConcreteCMS

GHSA-645j-cm4x-3xvw

LFI PHP Path Traversal RCE

9.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 21:03 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader's extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code execution. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 9.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

Authenticated remote code execution in Concrete CMS 9.5.0 and earlier allows an administrator with composer form editing privileges to chain a path traversal flaw in the ptComposerFormLayoutSetControlCustomTemplate field with the platform's permissive file uploader to execute arbitrary PHP on the server. The vendor scored this 9.4 (CVSS v4.0) reflecting high confidentiality, integrity, and availability impact across both the vulnerable component and downstream subsequent systems. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Concrete CMS is a PHP-based content management system whose page type composer allows administrators to define custom form layouts via template parameters. The vulnerable parameter, ptComposerFormLayoutSetControlCustomTemplate, is consumed when saving composer layouts and is passed into a PHP include/require path without sanitizing '../' traversal sequences - the textbook root cause classified by CWE-98 (Improper Control of Filename for Include/Require Statement, i.e., PHP Remote File Inclusion / Local File Inclusion). The exploitability is amplified by Concrete CMS's file uploader, which validates uploads by file extension only and therefore happily stores PHP source code inside files named with image extensions such as .png; an LFI primitive that can reference such an uploaded file becomes a full RCE primitive. The single affected CPE is cpe:2.3:a:concrete_cms:concrete_cms across versions up to and including 9.5.0.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later, which is referenced in the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes as the patched version addressing this issue. Until the upgrade can be applied, restrict the 'edit composer forms' permission to the smallest possible set of trusted administrators and audit recent assignments of that right, since the entire attack surface depends on it; additionally consider blocking write access to page type composer layouts at the web tier (WAF rule on requests carrying the ptComposerFormLayoutSetControlCustomTemplate parameter containing '../' or absolute paths) which has the side effect of breaking legitimate template customization. As a hardening measure, reconfigure the webserver or PHP to refuse execution of .php content inside the file-storage upload directories (e.g., an Apache 'php_flag engine off' or nginx location block), which mitigates the uploader's extension-only validation flaw but may interfere with any legitimate dynamic content stored there.