---
id: CVE-2026-7888
title: >-
  Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via
  unserialize() calls in the Workflow, Form block, and File/Set components that
  lack the allowed_classes restriction.
summary: >-
  Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via
  unserialize()

  calls in the Workflow, Form block, and File/Set components that lack the

  allowed_classes restriction. The Form block and File/Set sinks were addressed
  in

  9.…
severity: high
cvss: 8.4
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-502
vendor: Concrete CMS
product: Concrete CMS
affected:
  - concrete_cms >= 5.0 <= 9.5.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-03T19:07:44.886735Z'
published: '2026-06-03'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T19:04:23.786Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-7888'
references:
  - url: >-
      https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes
tags:
  - cve.org
epss: 0.00385
epssPercentile: 0.29948
ingestedAt: '2026-09-14T00:35:28.535Z'
---

## Overview

Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize()
calls in the Workflow, Form block, and File/Set components that lack the
allowed_classes restriction. The Form block and File/Set sinks were addressed in
9.5.2; the Workflow component sinks were addressed in 9.5.3. An unauthenticated
attacker may trigger arbitrary PHP object instantiation if a malicious serialized
payload has been placed in the database. Thanks XananasX7 and Sanjorn Keeratirungsan
(dizconnect) for independently reporting the original components, and sh4d0byss for
reporting the Workflow component wasn't fixed in 9.5.2. The Concrete CMS security team gave this
vulnerability a CVSS v.4.0 score of 8.4 with vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/
VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

## Affected

- `concrete_cms >= 5.0 <= 9.5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.