CVE-2026-10721: Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10721?
The severity of CVE-2026-10721 is high with a CVSS score of 8.4.
How do I fix CVE-2026-10721?
To fix CVE-2026-10721, upgrade Concrete CMS to version 9.5.2 or later.
What type of vulnerability is identified in CVE-2026-10721?
CVE-2026-10721 is a PHP Object Injection vulnerability caused by unsafe unserialize() calls.
Who is affected by CVE-2026-10721?
All versions of Concrete CMS below 9.5.2 are affected by CVE-2026-10721.
What can an attacker do with CVE-2026-10721?
An attacker can exploit CVE-2026-10721 to trigger arbitrary PHP object instantiation if they place a malicious serialized payload in the database.