GHSA-pv2v-6w2v-97x6 — high GitHub Advisory (CVE-2026-8135) in composer/concrete5/concrete5

Description

Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rogue administrator with privileges to add blocks to an area can bypass the intended protection mechanism (_fromCIF === true), which normally restricts malicious inputs over form POST requests, by leveraging the REST API functionality. Because the REST API parses requests using json_decode(), the string "true" is evaluated as a strict PHP Boolean(true). This bypass allows the attacker to inject a malicious serialized payload into the block's filterFields database column. The payload will subsequently be executed when the block's data is viewed or edited by an administrator leading to complete server takeover (RCE). Concrete CMS thanks Nguyễn Văn Thiện https://github.com/Thien225409 for reporting this issue.

Basic information

Type: reviewed
Severity: high
Advisory on GitHub: Open advisory ↗
Repository advisory: —
Source code: Browse source ↗
Published (advisory): 2026-05-21 21:30:37 UTC
Updated: 2026-06-23 22:58:00 UTC
GitHub reviewed: 2026-06-23 22:57:59 UTC
NVD published: 2026-05-21

Score	Percentile
0.47%	36.94%

CVSS Scores

Base score	Version	Severity	Vector
8.9	4.0	—	`CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network. Attack complexity (AC:H) Exploitation depends on constrained or hard-to-reproduce conditions. Attack requirements (AT:P) Additional preconditions must be present for exploitation. Privileges required (PR:H) High privileges are required. User interaction (UI:N) No user interaction is required. Vulnerable system confidentiality impact (VC:H) High confidentiality impact on the vulnerable system. Vulnerable system integrity impact (VI:H) High integrity impact on the vulnerable system. Vulnerable system availability impact (VA:H) High availability impact on the vulnerable system. Subsequent system confidentiality impact (SC:H) High confidentiality impact on subsequent systems. Subsequent system integrity impact (SI:H) High integrity impact on subsequent systems. Subsequent system availability impact (SA:H) High availability impact on subsequent systems.

Identifiers

Type	Value
GHSA	GHSA-pv2v-6w2v-97x6 ↗
CVE	CVE-2026-8135 ↗

CWEs

CWE id	Name
CWE-502	Deserialization of Untrusted Data

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
composer	concrete5/concrete5	< 9.5.1	9.5.1	—

Concrete CMS Vulnerable to Deserialization of Untrusted Data