CVE-2026-10721

Vulnerability

Concrete CMS versions prior to 9.5.2 are susceptible to PHP Object Injection. This vulnerability exists within the Permission, Cache, and Search components due to insecure unserialize() calls. An unauthenticated attacker can trigger arbitrary PHP object instantiation if a malicious serialized payload is present in the database.

Exploitation

An unauthenticated attacker needs to place a malicious serialized PHP object payload into the database. Once the payload is in the database, the application will deserialize it when processing requests related to the affected components, leading to the instantiation of arbitrary PHP objects.

Impact

Successful exploitation allows an attacker to instantiate arbitrary PHP objects, which can lead to arbitrary code execution on the server. The scope and privilege level of the compromise depend on the context in which the deserialization occurs.

Mitigation

Concrete CMS version 9.5.2 and later include a security fix that adds allowed_classes to unserialize() calls within the Permission, Cache, and Search components, preventing PHP Object Injection. The fix was released on June 10, 2026 [1].