CVE-2026-10721

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 for reporting.

CVSS

No CVSS.

References

Link	Resource
https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Concrete CMS anterior a la versión 9.5.2 es vulnerable a la Inyección de Objetos PHP a través de llamadas a unserialize() en los componentes de Permisos, Caché y Búsqueda. Un atacante no autenticado puede desencadenar la instanciación arbitraria de objetos PHP si una carga útil serializada maliciosa ha sido colocada en la base de datos. Gracias a XananasX7 por el informe.

10 Jun 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-10 08:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-10721

Mitre link : CVE-2026-10721

CVE.ORG link : CVE-2026-10721

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-10721", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10721", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-10T14:39:28.773945Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "affectedData": [{"repo": "https://github.com/concretecms/concretecms", "vendor": "Concrete CMS", "product": "Concrete CMS", "versions": [{"status": "affected", "version": "5", "versionType": "git", "lessThanOrEqual": "9.5.1"}], "collectionURL": "https://github.com/concretecms/concretecms", "defaultStatus": "unaffected"}]}], "published": "2026-06-10T08:16:22.330", "references": [{"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes", "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via\u00a0unserialize()\u00a0calls in the\u00a0\u00a0in Permission, Cache, and Search\u00a0components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 for\u00a0reporting."}, {"lang": "es", "value": "Concrete CMS anterior a la versi\u00f3n 9.5.2 es vulnerable a la Inyecci\u00f3n de Objetos PHP a trav\u00e9s de llamadas a unserialize() en los componentes de Permisos, Cach\u00e9 y B\u00fasqueda. Un atacante no autenticado puede desencadenar la instanciaci\u00f3n arbitraria de objetos PHP si una carga \u00fatil serializada maliciosa ha sido colocada en la base de datos. Gracias a XananasX7 por el informe."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "ff5b8ace-8b95-4078-9743-eac1ca5451de"}