CVE-2026-3452

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3452", "assignerOrgId": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "state": "PUBLISHED", "assignerShortName": "ConcreteCMS", "dateReserved": "2026-03-02T17:51:28.741Z", "datePublished": "2026-03-04T01:49:27.027Z", "dateUpdated": "2026-03-04T16:02:10.496Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/concretecms/concretecms", "defaultStatus": "unaffected", "product": "Concrete CMS", "repo": "https://github.com/concretecms/concretecms", "vendor": "Concrete CMS", "versions": [{"lessThan": "9.4.8", "status": "affected", "version": "5", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "YJK (@YJK0805) of ZUSO ART"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div><br></div><div><div><div><div><div></div></div></div></div></div></div><div><div><div><div>Concrete CMS below version 9.4.8 is vulnerable to&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">Remote Code Execution by&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">stored PHP object injection into the Express Entry List block</span>&nbsp;via the columns parameter.&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to </span><code>unserialize()</code><span style=\"background-color: rgb(255, 255, 255);\"> without class restrictions or integrity checks.&nbsp;The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector&nbsp;CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">YJK (</span><a target=\"_blank\" rel=\"nofollow\" href=\"https://hackerone.com/yjk0805\">@YJK0805</a><span style=\"background-color: rgb(255, 255, 255);\">) of </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://zuso.ai/\">ZUSO ART</a>&nbsp;for reporting.&nbsp;</span></div></div></div></div><br>"}], "value": "Concrete CMS below version 9.4.8 is vulnerable to\u00a0Remote Code Execution by\u00a0stored PHP object injection into the Express Entry List block\u00a0via the columns parameter.\u00a0An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to unserialize() without class restrictions or integrity checks.\u00a0The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector\u00a0CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks\u00a0YJK ( @YJK0805 https://hackerone.com/yjk0805 ) of ZUSO ART https://zuso.ai/ \u00a0for reporting."}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.9, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "shortName": "ConcreteCMS", "dateUpdated": "2026-03-04T01:49:27.027Z"}, "references": [{"url": "https://github.com/concretecms/concretecms/pull/12826/changes/167f16e4805d8ab546d2997c753ac21bf4854920://"}, {"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes"}], "source": {"advisory": "3549050", "defect": ["HackerOne"], "discovery": "UNKNOWN"}, "title": "Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T16:02:03.237046Z", "id": "CVE-2026-3452", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T16:02:10.496Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3452", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-04T16:02:03.237046Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T16:02:06.888Z"}}], "cna": {"title": "Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.", "source": {"defect": ["HackerOne"], "advisory": "3549050", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "YJK (@YJK0805) of ZUSO ART"}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/concretecms/concretecms", "vendor": "Concrete CMS", "product": "Concrete CMS", "versions": [{"status": "affected", "version": "5", "lessThan": "9.4.8", "versionType": "git"}], "collectionURL": "https://github.com/concretecms/concretecms", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/concretecms/concretecms/pull/12826/changes/167f16e4805d8ab546d2997c753ac21bf4854920://"}, {"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Concrete CMS below version 9.4.8 is vulnerable to\u00a0Remote Code Execution by\u00a0stored PHP object injection into the Express Entry List block\u00a0via the columns parameter.\u00a0An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to unserialize() without class restrictions or integrity checks.\u00a0The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector\u00a0CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks\u00a0YJK ( @YJK0805 https://hackerone.com/yjk0805 ) of ZUSO ART https://zuso.ai/ \u00a0for reporting.", "supportingMedia": [{"type": "text/html", "value": "<div><div><br></div><div><div><div><div><div></div></div></div></div></div></div><div><div><div><div>Concrete CMS below version 9.4.8 is vulnerable to&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">Remote Code Execution by&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">stored PHP object injection into the Express Entry List block</span>&nbsp;via the columns parameter.&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to </span><code>unserialize()</code><span style=\"background-color: rgb(255, 255, 255);\"> without class restrictions or integrity checks.&nbsp;The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector&nbsp;CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">YJK (</span><a target=\"_blank\" rel=\"nofollow\" href=\"https://hackerone.com/yjk0805\">@YJK0805</a><span style=\"background-color: rgb(255, 255, 255);\">) of </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://zuso.ai/\">ZUSO ART</a>&nbsp;for reporting.&nbsp;</span></div></div></div></div><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "shortName": "ConcreteCMS", "dateUpdated": "2026-03-04T01:49:27.027Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3452", "state": "PUBLISHED", "dateUpdated": "2026-03-04T16:02:10.496Z", "dateReserved": "2026-03-02T17:51:28.741Z", "assignerOrgId": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "datePublished": "2026-03-04T01:49:27.027Z", "assignerShortName": "ConcreteCMS"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/concretecms/concretecms", "defaultStatus": "unaffected", "product": "Concrete CMS", "repo": "https://github.com/concretecms/concretecms", "vendor": "Concrete CMS", "versions": [{"lessThan": "9.4.8", "status": "affected", "version": "5", "versionType": "git"}]}], "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "BCBFD93E-6A10-4E9F-A31E-4A2C1FCD367C", "versionEndExcluding": "9.4.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Concrete CMS below version 9.4.8 is vulnerable to\u00a0Remote Code Execution by\u00a0stored PHP object injection into the Express Entry List block\u00a0via the columns parameter.\u00a0An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to unserialize() without class restrictions or integrity checks.\u00a0The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector\u00a0CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks\u00a0YJK ( @YJK0805 https://hackerone.com/yjk0805 ) of ZUSO ART https://zuso.ai/ \u00a0for reporting."}, {"lang": "es", "value": "Concrete CMS en versiones anteriores a la 9.4.8 es vulnerable a ejecuci\u00f3n remota de c\u00f3digo mediante inyecci\u00f3n de objetos PHP almacenados en el bloque Express Entry List a trav\u00e9s del par\u00e1metro columns. Un administrador autenticado puede almacenar datos serializados controlados por el atacante en campos de configuraci\u00f3n de bloques que posteriormente se pasan a unserialize() sin restricciones de clase ni comprobaciones de integridad. El equipo de seguridad de Concrete CMS asign\u00f3 a esta vulnerabilidad una puntuaci\u00f3n CVSS v.4.0 de 8.9 con el vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Gracias a YJK ( @YJK0805 https://hackerone.com/yjk0805 ) de ZUSO ART https://zuso.ai/ por informar."}], "id": "CVE-2026-3452", "lastModified": "2026-06-17T10:43:36.453", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3452", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T16:02:03.237046Z", "version": "2.0.3"}}]}, "published": "2026-03-04T02:15:54.840", "references": [{"source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "tags": ["Patch", "Release Notes", "Vendor Advisory"], "url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes"}, {"source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "tags": ["Broken Link"], "url": "https://github.com/concretecms/concretecms/pull/12826/changes/167f16e4805d8ab546d2997c753ac21bf4854920://"}], "sourceIdentifier": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5,9.4.8)"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "Concrete CMS", "source": "cna", "vendor": "Concrete CMS"}, "product": "concrete_cms", "vendor": "concretecms"}], "analysis": {"en": {"generated_at": "2026-04-16T13:47:54.616110+00:00", "value": {"mitigation_remediation": ["Upgrade Concrete CMS to version 9.4.8 or later to eliminate the unsanitized unserialize() call.", "Immediately restrict administrative access to block configuration pages and ensure only trusted users can edit the Express Entry List block.", "Apply general PHP security hardening: disable native PHP object deserialization of external data or validate serialized payloads against permitted classes if upgrades cannot be applied promptly."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via Stored PHP Object Injection"}, "threat_synthesis": {"affected_systems": "All installations of Concrete CMS using versions older than 9.4.8 are affected. The vulnerability specifically targets the Express Entry List block component in those releases.", "description_and_impact": "Concrete CMS below version 9.4.8 can be manipulated by an authenticated administrator to store attacker\u2011controlled serialized data in the Express Entry List block configuration. The block later passes this data to PHP\u2019s unserialize() without class restrictions or integrity checks, allowing an attacker to execute arbitrary code on the web server. The vulnerability is a stored PHP object injection, identified as CWE\u2011502, and grants full control of the compromised system.", "risk_and_exploitability": "The CVSS v4.0 score of 8.9 indicates a high\u2011severity flaw; however, the EPSS score of less than 1% suggests it is currently not widely exploited. The vulnerability is not listed in the CISA KEV catalog. Exploitation is remote but requires authenticated administrative access to store malicious serialized payloads. Once executed, the attacker can run arbitrary code with the permissions of the web process, leading to complete system compromise."}}}}, "created": "2026-03-04T14:53:22.232893+00:00", "updated": "2026-04-16T14:00:19.459441+00:00", "vendors": ["concretecms", "concretecms$PRODUCT$concrete_cms"]}