CVE-2026-3452

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parameter. An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are later passed to unserialize() without class restrictions or integrity checks. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks YJK ( @YJK0805 https://hackerone.com/yjk0805 ) of ZUSO ART https://zuso.ai/ for reporting.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Mar 4, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-345209.1AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most CVE-2026-345228.1SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-345235.3SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-345248.8SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-345255.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed CVE-2026-345265.0SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-345275.3Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, SbieIniServer::HashPassword c CVE-2026-345289.8File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-345299.0File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-34538.1The ProfilePress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.16.11. This CVE-2026-345306.9File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-345318.2Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the clien