CVE-2026-7888: Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction.

Synopsis

PHP Object Injection in Concrete CMS below version 9.5.2 allows arbitrary PHP object instantiation through unsafe unserialize() calls in the Workflow, Form block, and File/Set components. The CVSS vector indicates local access is required, meaning an attacker must first place a malicious serialized payload into the database before exploitation can occur, which typically requires elevated privileges. Successful exploitation gives the attacker full read, write, and availability impact over the application's data and processes. A patched-image rebuild at version 9.5.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network path to the vulnerable component is required.

• AuthenticationRequired

  A high-privilege (admin) account is needed to place the malicious serialized payload into the database before the injection can be triggered.

• Victim interactionNot required

  No victim interaction is required; exploitation proceeds without any user action once the payload is in place.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental factors beyond having the payload staged in the database.

Blast Radius

• Reads all application data accessible to the PHP process, including stored session tokens, user credentials, and uploaded file metadata.
• Modifies persisted database rows and filesystem content, allowing an attacker to alter site content, inject backdoors, or tamper with workflow records.
• Crashes or disrupts the affected Concrete CMS service by instantiating PHP objects that trigger fatal errors or exhaust resources.
• Achieves arbitrary code execution in the application context through gadget chains invoked during PHP object instantiation.