CVE-2026-3452

The record

Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parameter. An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to unserialize() without class restrictions or integrity checks. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks YJK ( @YJK0805 https://hackerone.com/yjk0805 ) of ZUSO ART https://zuso.ai/  for reporting.

Affected packages

Related vulnerabilities

• GHSA-gj26-w59c-29mf Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection Same vulnerability
• GHSA-w9qg-chfh-g3q9 Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Also affects concrete5/concrete5
• GHSA-45fj-fvmm-xcc5 Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Also affects concrete5/concrete5
• GHSA-6mxw-2vhf-42g5 Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF) Also affects concrete5/concrete5
• GHSA-f4vq-pj32-gr4q Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Also affects concrete5/concrete5
• GHSA-mm5f-5rqw-574f Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Also affects concrete5/concrete5
• CVE-2026-3241 In Concrete CMS below version 9.4.8, a stored cross-site scripting (XSS) vulnerability… Also affects concrete5/concrete5
• CVE-2026-3242 In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the… Also affects concrete5/concrete5