🚨High - Concrete CMS PHP Object Injection (CVE-2026-10721) Concrete CMS (formerly concrete5) below 9.5.2 is vulnerable to PHP Object Injection (CWE-502, insecure deserialization). The Permission, Cache, and Search components call unserialize() on stored data without restricting allowed classes, so a crafted serialized payload placed into the relevant store can instantiate arbitrary PHP objects, potentially leading to remote code execution. Per the Concrete CMS security team it carries a CVSS v4.0 score of 8.4: it requires high privileges (an attacker able to write the malicious serialized data) and no user interaction, with full C/I/A impact. Fixed in 9.5.2, which adds allowed_classes restrictions to the affected unserialize() calls. 👉Upgrade Concrete CMS to version 9.5.2 or later.
Post summary
The post details a remote code execution vulnerability in Concrete CMS versions below 9.5.2 caused by PHP Object Injection, provides technical details, and recommends upgrading to 9.5.2 for a fix.