High severity · published Jun 10, 2026
CVE-2026-10721
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components
8.4
CVSS
0.1%
EPSS
No
On KEV
Description
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 for reporting.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Concrete CMS · Concrete CMS
5 through 9.5.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10721
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10721
documentation.concretecms.org
https://documentation.concretecms.org/9-x/developers/introduction/version-history/952-release-notes
More from Concrete CMS
9.6
CVE-2026-85385
Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field
9.0
CVE-2026-18119
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values
8.8
CVE-2026-8409
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete
8.8
CVE-2026-8410
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete
8.8
CVE-2026-8411
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete