CVE-2026-10721: Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components

Synopsis

PHP Object Injection in Concrete CMS (versions up to and including 9.5.1) allows an attacker who can write a malicious serialized payload to the database to trigger arbitrary PHP object instantiation through unsafe unserialize() calls in the Permission, Cache, and Search components. The vulnerability requires local access (an existing foothold on the host) and high-privilege credentials, meaning a compromised admin account or direct database access is a prerequisite. Successful exploitation enables full read, write, and denial-of-service impact on the affected host. HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network exposure is required to trigger the unserialize() calls.

• AuthenticationRequired

  A high-privilege (admin) account or equivalent direct database access is needed to place the malicious serialized payload.

• Victim interactionNot required

  No victim interaction is required once the payload is written to the database; the application triggers deserialization on its own.

• Attack complexityDetail

  The exploit is reliable and condition-free once prerequisites are met; no race conditions or special environmental factors are required.

Blast Radius

• Reads any data accessible to the PHP process, including stored credentials, session tokens, and site configuration.
• Modifies or overwrites persisted database rows and filesystem content reachable by the web server user.
• Crashes or disrupts the affected Concrete CMS service by corrupting internal object state during deserialization.
• Arbitrary PHP object instantiation can chain available classes (a POP chain) to escalate toward remote code execution on the host.