Remote Code Execution Vulnerability in Concrete CMS by PHP Object Injection

CVE-2026-3452

What is CVE-2026-3452?

Concrete CMS prior to version 9.4.8 is susceptible to a serious security flaw that allows Remote Code Execution through PHP object injection. This issue arises when an authenticated administrator can inject attacker-controlled serialized data into the configuration of the Express Entry List block via the columns parameter. Since this data is later processed using the unserialize() function without adequate class restrictions or integrity checks, it presents an opportunity for malicious actors to execute arbitrary code. This vulnerability highlights the importance of securing admin functionalities and ensuring data integrity in web applications.

References