CVE-2026-8134
Path Traversal in Concrete CMS Leads to RCE
Publication date: 2026-05-21
Last updated on: 2026-05-21
Assigner: ConcreteCMS
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| concrete_cms | concrete_cms | to 9.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-23 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. |
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Concrete CMS version 9.5.0 and below. It occurs because the system fails to properly sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts.
An authenticated rogue administrator who has composer form editing rights can exploit this flaw to include arbitrary readable files from the server. Additionally, because the file uploader only validates file extensions (allowing PHP code disguised with image extensions like .png), this can lead to authenticated remote code execution.
How can this vulnerability impact me? :
The vulnerability can have severe impacts including unauthorized access to arbitrary files on the server and potentially full remote code execution by an authenticated rogue administrator.
This means an attacker with certain privileges could execute malicious code on the server, potentially compromising the entire system, stealing sensitive data, or disrupting services.