CVE-2026-3452: 
PHP vulnerability analysis and mitigation

CVE-2026-3452 is a stored PHP object injection vulnerability in Concrete CMS that enables Remote Code Execution (RCE) via the Express Entry List block's columns parameter. It affects all Concrete CMS versions below 9.4.8. An authenticated administrator can store attacker-controlled serialized data in block configuration fields that are subsequently passed to unserialize() without class restrictions or integrity checks. The vulnerability was disclosed on March 4, 2026, with a CVSS v3.1 base score of 7.2 (High) and a vendor-assigned CVSS v4.0 score of 8.9 (High) (Red Hat CVE, Concrete CMS Release Notes).

The root cause is improper deserialization of untrusted data (CWE-502), classified under CAPEC-586 (Object Injection). When an administrator configures the Express Entry List block, the columns parameter accepts serialized PHP data that is later passed directly to PHP's unserialize() function without any allowlist of permitted classes or cryptographic integrity verification. This allows an attacker with administrative access to craft a malicious serialized PHP object (a "gadget chain") that, when deserialized by the server, triggers arbitrary code execution. The vulnerability was reported by researcher YJK (@YJK0805) of ZUSO ART via HackerOne (Red Hat CVE, Concrete CMS Release Notes).

Successful exploitation grants an attacker full remote code execution on the underlying server as the web application's process user, leading to complete compromise of the Concrete CMS instance. This includes unauthorized access to sensitive data (database credentials, user data, site content), arbitrary modification or deletion of site content, and potential lateral movement within the hosting infrastructure if the server has network access to internal systems. Both the vulnerable system and any connected systems (sub-systems) face high confidentiality, integrity, and availability impacts per the CVSS v4.0 scoring (Red Hat CVE).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.51%, reflecting a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated administrator-level access, which significantly limits the attack surface but does not eliminate risk in scenarios involving compromised admin credentials or insider threats.

1. Gain Administrator Access: Obtain valid Concrete CMS administrator credentials through phishing, credential stuffing, or another compromise vector targeting the admin panel.
2. Navigate to Express Entry List Block: Log into the Concrete CMS admin dashboard and add or edit an Express Entry List block on any page.
3. Craft Malicious Serialized Payload: Using a PHP gadget chain tool (e.g., PHPGGC), generate a malicious serialized PHP object targeting a class available in the Concrete CMS or its dependencies that can trigger code execution upon deserialization.
4. Inject Payload via Columns Parameter: Submit the crafted serialized string as the value of the columns parameter in the block's configuration form and save the block.
5. Trigger Deserialization: Load or render the page containing the configured block. The server calls unserialize() on the stored columns value without class restrictions, instantiating the attacker's gadget chain.
6. Achieve Remote Code Execution: The deserialized gadget chain executes arbitrary PHP/OS commands on the server, enabling reverse shell establishment, data exfiltration, or further persistence (Red Hat CVE, Concrete CMS Release Notes).

• Logs: Concrete CMS or web server access logs showing POST requests to block configuration endpoints (e.g., /index.php/ccm/system/block/render or similar) containing base64-encoded or raw serialized PHP strings (beginning with O:, a:, s:) in the columns parameter.
• File System: Unexpected PHP web shells or new files in the Concrete CMS application directory or upload folders; modified core PHP files with injected code.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., bash, sh, curl, wget, python, nc) that are not typical for normal CMS operation.
• Network: Outbound connections from the web server to unknown external IP addresses or domains, particularly on non-standard ports, which may indicate reverse shell or C2 communication.
• Database: New administrator accounts created in the Concrete CMS users table, or unexpected changes to block configuration data containing serialized PHP strings in the btExpressEntryList or related block tables.

The primary remediation is to upgrade Concrete CMS to version 9.4.8 or later, which addresses this vulnerability by adding proper class restrictions and integrity checks to the deserialization process (Concrete CMS Release Notes). As interim mitigations, restrict administrative access strictly to trusted users and enforce multi-factor authentication on admin accounts. If the Express Entry List block is not actively used, consider disabling it until the patch is applied. Additionally, implement web application firewall (WAF) rules to detect and block requests containing serialized PHP object patterns in block configuration parameters.

The vulnerability was reported through HackerOne by researcher YJK (@YJK0805) of ZUSO ART, and the Concrete CMS security team acknowledged and scored it at CVSS v4.0 8.9. Security aggregators including Red Hat, INCIBE-CERT, and ENISA's EUVD catalogued the vulnerability shortly after disclosure. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability tracking and alerting (Red Hat CVE, Infinit Security).