Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller._CVE-2026-8135

{
    "lastseen": "",
    "description": "Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution  due to insecure deserialization occurring in the\u00a0ExpressEntryList\u00a0block controller. An rogue administrator with privileges to add blocks to an area can bypass the intended protection mechanism (_fromCIF === true), which normally restricts malicious inputs over form POST requests, by leveraging the REST API functionality. Because the REST API parses requests using json_decode(), the string \"true\" is evaluated as a strict PHP Boolean(true).\u00a0 This bypass allows the attacker to inject a malicious serialized payload \u00a0into the block's filterFields database column. The payload will subsequently be executed when the block's data is viewed or edited by an administrator leading to complete server takeover (RCE).The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with a vector of\u00a0CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H.\u00a0 Thanks  Nguy\u1ec5n V\u0103n Thi\u1ec7n https://github.com/Thien225409 \u00a0for reporting",
    "published": "2026-05-21T20:16:39.866Z",
    "modified": "2026-05-21T20:16:39.866Z",
    "type": "cve",
    "title": "Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller.",
    "source": "ConcreteCMS",
    "references": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes",
    "id": "CVE-2026-8135",
    "bulletinFamily": "",
    "cwe": [
        "CWE-502"
    ],
    "cvelist": null,
    "sourceData": "Concrete CMS Concrete CMS 5.0",
    "sourceHref": "",
    "cvss": {
        "score": 8.9,
        "severity": "HIGH",
        "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Concrete CMS",
    "version": "5.0",
    "vendor": "Concrete CMS",
    "ai_description": "Remote Code Execution due to insecure deserialization in the ExpressEntryList block controller",
    "ai_severity": "High",
    "ai_vendor": "Concrete CMS",
    "ai_product": "Concrete CMS",
    "ai_version": "9.5.0 and below",
    "ai_score": 8.9
}