Concrete CMS EUVD-2026-31335

Exploitation requires an authenticated Concrete CMS administrator account that has been granted page type composer form editing rights (CVSS PR:H), plus the ability to upload a file through the standard Concrete CMS file uploader - both are normal admin-tier capabilities rather than non-default features. The vulnerable parameter is specifically ptComposerFormLayoutSetControlCustomTemplate within the composer form layout save flow, and the RCE escalation specifically depends on the file uploader accepting PHP payloads inside files named with permitted extensions such as .png. Limiting factors: no anonymous or low-privilege user can trigger this, no end-user interaction is required (UI:N), and the target must be running Concrete CMS 5.0 through 9.5.0 with a webserver configuration that executes PHP from the uploads directory (most default LAMP-style deployments do).

The vendor-assigned CVSS v4.0 base of 9.4 (AV:N/AC:L/AT:N/PR:H/UI:N) reflects network-reachable, low-complexity exploitation with no user interaction, but it requires high privileges - specifically an administrator account that already holds composer form editing rights - which materially limits the attacker population. The high subsequent-system impact metrics (SC:H/SI:H/SA:H) indicate the vendor believes successful exploitation can pivot beyond the CMS process boundary, which is consistent with arbitrary PHP execution under the webserver account. EPSS score and KEV status are not provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild use cannot be asserted; no public exploit is identified at time of analysis. Real-world priority should be treated as high for any Concrete CMS deployment with multiple admin-tier users (insider-threat / compromised-credential scenarios), and moderate for tightly held single-admin deployments - the privilege prerequisite is the dominant risk modulator.

A disgruntled or compromised mid-tier administrator who holds composer form editing rights first uploads a PHP webshell disguised as image.png through the standard file manager (accepted because validation is extension-only), then saves a page type composer form layout where the ptComposerFormLayoutSetControlCustomTemplate field contains a traversal path like '../../../../application/files/0000/0000/0001/image.png'. When the layout is rendered, Concrete CMS includes the uploaded file as PHP, executing the attacker's code in the webserver context and yielding full server-side command execution.