Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.

Root

Cause

CVE-2026-3452 is a remote code execution vulnerability in Concrete CMS versions prior to 9.4.8. The flaw resides in the Express Entry List block, where the columns parameter accepts attacker-controlled serialized data during block configuration. This data is later passed to unserialize() without any class restrictions or integrity checks, enabling PHP object injection [1][2].

Exploitation

An authenticated administrator can store malicious serialized objects in the block configuration fields. The attack requires high privileges (administrator) and involves crafting a payload that, upon unserialization, triggers arbitrary code execution. The CVSS v4.0 vector highlights the complexity and prerequisites: AV:N/AC:H/AT:P/PR:H/UI:N, indicating network access, high attack complexity, and privileged account requirements [1].

Impact

Successful exploitation grants the attacker full control over the affected server, including the ability to read, modify, or delete sensitive data, and potentially pivot to other systems. The CVSS score of 8.9 reflects high impacts on confidentiality, integrity, and availability, both on the vulnerable system and subsequent scope [1][2].

Mitigation

Concrete CMS has released version 9.4.8, which fixes the issue by initializing columns and filterFields from empty values, preventing injection of serialized attacker data. Users are strongly advised to upgrade immediately. No workarounds have been published, and the published for older versions [2].