CVE-2026-7888: Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction.
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowedclasses restriction. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 and Sanjorn Keeratirungsan (dizconnect) for both independently reporting. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.4 with vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.5.2 - Configuration
Modify the unserialize() usage in the Workflow, Form block, and File/Set components to enforce an allowed_classes restriction (the vulnerable behavior described is missing this restriction).
Concrete CMS (Workflow, Form block, File/Set components) allowed_classes restriction for unserialize() = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7888?
CVE-2026-7888 has a risk score of 54, indicating a medium severity vulnerability.
How do I fix CVE-2026-7888?
To fix CVE-2026-7888, upgrade Concrete CMS to version 9.5.2 or higher, which mitigates the PHP Object Injection vulnerability.
What are the components affected by CVE-2026-7888?
CVE-2026-7888 affects the Workflow, Form block, and File/Set components of Concrete CMS.
Who can exploit CVE-2026-7888?
An unauthenticated attacker can exploit CVE-2026-7888 by sending a malicious serialized payload to trigger arbitrary PHP object instantiation.
What is PHP Object Injection in the context of CVE-2026-7888?
In the context of CVE-2026-7888, PHP Object Injection refers to the vulnerability allowing attackers to instantiate arbitrary PHP objects through insecure unserialize() calls.