Concrete CMS CVE-2026-8135

Exploitation requires an authenticated Concrete CMS administrator account with permission to add or modify blocks in an area, reachability of the REST API endpoint that routes to the ExpressEntryList block controller, and a second administrator who subsequently views or edits the malicious block to trigger the unserialize() sink. Limiting factors are significant: PR:H means the attacker is already privileged, AC:H reflects the non-obvious JSON-vs-form parser bypass, AT:P captures the dependency on a victim administrator interacting with the planted block, and the target must be running Concrete CMS 9.5.0 or earlier with the REST API enabled. Single-administrator deployments do not satisfy the secondary-admin trigger condition under realistic conditions.

The CVSS v4.0 score of 8.9 reflects the severe technical impact (VC/VI/VA all High, plus subsequent-system High across the board) tempered by meaningful exploitation barriers: AC:H (high attack complexity), AT:P (present attack requirements such as a second admin triggering deserialization), and PR:H (the attacker must already hold administrator privileges with block-creation rights). There is no EPSS data, no CISA KEV listing, and no SSVC decision provided, and no public exploit identified at time of analysis - so this is not a mass-exploitation candidate. Real-world risk is concentrated in multi-tenant or delegated-admin deployments where a lower-trust admin role could pivot to host compromise; in single-admin installations the practical risk is lower because the attacker would already be at the highest application tier. The PR:H prerequisite and the requirement that another admin later view/edit the malicious block are concrete limiters that defenders should weight against the raw 8.9 score.

A rogue or compromised low-trust administrator on a multi-admin Concrete CMS site issues a crafted REST API request to create or update an ExpressEntryList block, embedding "_fromCIF": true in JSON so the strict-identity guard passes, and stores a serialized PHP gadget chain in filterFields. When a higher-privileged administrator later opens the affected page or edits the block, the payload is deserialized server-side and executes arbitrary PHP code under the web server account, yielding full host takeover. No public exploit identified at time of analysis, but the bypass mechanic is fully described in the advisory and is straightforward to reproduce.