Concrete CMS: PHP Object Injection via unserialize() calls

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-10721 · ADVISORY
• documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes · WEB
• concretecms/concretecms · PACKAGE

concrete5/concrete5 のその他の脆弱性

• CVE-2026-7888高 8.4Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components …
• CVE-2026-8353中 4.8Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScr…
• CVE-2026-8347中 4.3Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog.  This can cause Cr…
• CVE-2026-8340中 4.3Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents permission is CSRF'd int…
• CVE-2026-8435中 6.5Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Co…