PT-2026-46047

CVE-2026-7888

Published

2026-06-03

Updated

2026-09-11

Description by

CVSS 4.0

8.4

High

MetricsAV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.2

Description PHP Object Injection occurs due to the use of unserialize() calls within the Workflow, Form block, and File/Set components that do not implement the allowed classes restriction. This allows an unauthenticated attacker to trigger arbitrary PHP object instantiation if a malicious serialized payload is present in the database.

Recommendations Update to version 9.5.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Sanjorn Keeratirungsan

Sh4D0Byss

Xananasx7

Vendors

Affected products

Weakness enumeration