요약
- CVE-2026-7888은(는) concrete5/concrete5에 영향을 주는 높음 (CVSS 8.4) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.15%, 전체 취약점의 4.6%보다 높음.
- 조치: 9.5.2 이상으로 업데이트하세요.
Description
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. The Concrete CMS security team thanks XananasX7 and Sanjorn Keeratirungsan (dizconnect) for both independently reporting this ssue.
NVD description
Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize()
calls in the Workflow, Form block, and File/Set components that lack the
allowed_classes restriction. The Form block and File/Set sinks were addressed in
9.5.2; the Workflow component sinks were addressed in 9.5.3. An unauthenticated
attacker may trigger arbitrary PHP object instantiation if a malicious serialized
payload has been placed in the database. Thanks XananasX7 and Sanjorn Keeratirungsan
(dizconnect) for independently reporting the original components, and sh4d0byss for
reporting the Workflow component wasn't fixed in 9.5.2. The Concrete CMS security team gave this
vulnerability a CVSS v.4.0 score of 8.4 with vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/
VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free