Skip to content
OpenAdvisories

Vendor

Concrete CMS

139 known vulnerabilities.

Products

Concrete CMS 139
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.4
    CVE-2026-8134

    Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion

    Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit t…

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist