Which versions of Concrete CMS are affected by CVE-2026-8135?

Concrete CMS versions 5.0 through 9.5.0 contain a remote code execution vulnerability (CVSS 8.9) that could lead to full server compromise when exploited through REST API submissions.. A patch is available.

How to fix or mitigate CVE-2026-8135?

Within 24 hours: Inventory all Concrete CMS instances and document versions; restrict REST API access to essential endpoints only and enable comprehensive logging. Within 7 days: Contact Concrete CMS vendor for patch timeline; assess feasibility of upgrading to patched version (when released). Within 30 days: Either complete upgrade to patched version or establish persistent compensating controls; validate controls are functioning.

Concrete CMS CVE-2026-8135

Q: What is the CVSS score of CVE-2026-8135?

CVE-2026-8135 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31336 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-21 ConcreteCMS

GHSA-pv2v-6w2v-97x6

Deserialization PHP RCE

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 21:03 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rogue administrator with privileges to add blocks to an area can bypass the intended protection mechanism (_fromCIF === true), which normally restricts malicious inputs over form POST requests, by leveraging the REST API functionality. Because the REST API parses requests using json_decode(), the string "true" is evaluated as a strict PHP Boolean(true). This bypass allows the attacker to inject a malicious serialized payload into the block's filterFields database column. The payload will subsequently be executed when the block's data is viewed or edited by an administrator leading to complete server takeover (RCE).The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with a vector of CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks Nguyễn Văn Thiện https://github.com/Thien225409 for reporting

AnalysisAI

Remote code execution in Concrete CMS versions 5.0 through 9.5.0 allows a high-privileged administrator to bypass the platform's _fromCIF deserialization guard by submitting malicious payloads through the REST API instead of standard form POST requests. The flaw resides in the ExpressEntryList block controller (CWE-502) and stores a serialized PHP gadget in the filterFields database column, which is unmarshalled when another administrator subsequently views or edits the block, leading to full server takeover. No public exploit identified at time of analysis, and the issue is not present in CISA KEV.

Technical ContextAI

Concrete CMS is an open-source PHP-based content management system. The vulnerability lives in the ExpressEntryList block controller, which historically distinguishes between trusted internal flows and untrusted form POST requests via a _fromCIF === true check before unserializing block configuration data. When the same controller is reached through the REST API, request bodies are parsed with json_decode() rather than PHP's form parser, so the JSON literal true is decoded as a strict PHP boolean and satisfies the strict identity comparison - effectively neutralizing the protection. The attacker-controlled payload is written to the filterFields column and later passed to PHP unserialize(), the canonical CWE-502 sink, allowing arbitrary object instantiation and gadget-chain-driven code execution. Affected CPE is cpe:2.3:a:concrete_cms:concrete_cms:* for all versions at or below 9.5.0.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later, which is the vendor-released patch referenced in the 9.5.1 release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. Until the upgrade can be applied, restrict the administrator role so that only fully trusted personnel hold block-management privileges on Express-related areas, audit existing ExpressEntryList blocks for unexpected serialized content in the filterFields column, and block external network access to the REST API endpoints used to add or modify blocks (this will break programmatic content automation that relies on the REST surface, so coordinate with integration owners). Where feasible, place the admin interface behind an IP allowlist or VPN to reduce exposure of the REST API to additional administrators on untrusted networks.