PHP Object Injection in Concrete CMS

Executive Summary

CVE-2026-10721 is a vulnerability in Concrete CMS versions below 9.5.2 involving PHP Object Injection through unserialize() calls in the Permission, Cache, and Search components.

An unauthenticated attacker can exploit this by placing a malicious serialized payload in the database, which triggers arbitrary PHP object instantiation when unserialize() is called.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary PHP object instantiation, which can lead to serious security impacts including unauthorized code execution, data manipulation, or system compromise.

Because the attacker can trigger this without authentication, it poses a high risk to the confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the PHP Object Injection vulnerability in Concrete CMS below 9.5.2, you should upgrade to version 9.5.2 or later where the issue has been addressed.

The fix involves adding allowed_classes to the unserialize() calls in key components such as Form blocks and File/Set to prevent malicious serialized payloads from triggering arbitrary PHP object instantiation.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how CVE-2026-10721 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0