CVE-2026-10721: Concrete CMS RCE Vulnerability

CVE-2026-10721 Overview

CVE-2026-10721 is a PHP Object Injection vulnerability affecting Concrete CMS versions below 9.5.2. The flaw resides in unserialize() calls within the Permission, Cache, and Search components. An attacker who can place a malicious serialized payload in the database can trigger arbitrary PHP object instantiation when the affected code path deserializes the data. The issue is tracked under [CWE-502: Deserialization of Untrusted Data]. Concrete CMS addressed the vulnerability in release 9.5.2. The researcher credited in the advisory is XananasX7.

Critical Impact

Successful exploitation enables arbitrary PHP object instantiation, which can lead to code execution, data tampering, or full compromise of the Concrete CMS application.

Affected Products

• Concrete CMS versions prior to 9.5.2
• Permission, Cache, and Search components invoking unserialize()
• Deployments storing serialized PHP data in the backing database

Discovery Timeline

• 2026-06-10 - CVE-2026-10721 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-10721

Vulnerability Analysis

The vulnerability stems from unsafe use of PHP's unserialize() function on data retrieved from the database. Concrete CMS uses serialized PHP objects to persist Permission, Cache, and Search state. When the application reads these records, it passes the stored string directly to unserialize() without integrity validation or class allowlisting.

PHP Object Injection allows an attacker to control the type and properties of objects instantiated during deserialization. Magic methods such as __wakeup(), __destruct(), and __toString() execute automatically as objects are reconstructed. Chained together with classes available in the Concrete CMS codebase or its Composer dependencies, these methods form POP (Property-Oriented Programming) gadget chains that attackers can use to read files, write to disk, or invoke arbitrary code.

The advisory states the attack is unauthenticated at the deserialization step, but requires the attacker to first place a crafted serialized payload into the database. The CVSS 4.0 vector indicates a local attack vector with high privileges required, reflecting the prerequisite database write capability.

Root Cause

The root cause is calling unserialize() on attacker-influenced data without restricting allowed classes. PHP deserialization restores object state and triggers magic methods, turning any controllable serialized blob into an object instantiation primitive.

Attack Vector

The attacker must first introduce a malicious serialized payload into a database field that the Permission, Cache, or Search components later deserialize. This payload insertion can occur through a secondary vulnerability, a compromised privileged account, or any code path that writes user-influenced data to the affected records. Once the row is read by Concrete CMS, the unsafe unserialize() call instantiates attacker-chosen classes and executes their magic methods.

No verified proof-of-concept code is published in the referenced sources. See the ConcreteCMS 9.5.2 Release Notes for the vendor's remediation description.

Detection Methods for CVE-2026-10721

Indicators of Compromise

• Database records containing serialized PHP strings with class names not native to Concrete CMS, such as patterns matching O:\d+:"
• Unexpected file writes, outbound network connections, or PHP processes spawned by the web server user after accessing pages backed by the Permission, Cache, or Search components
• Errors or warnings from unserialize() in PHP error logs, including __wakeup or __destruct stack traces

Detection Strategies

• Audit Concrete CMS database tables for serialized values that reference classes outside the expected Concrete\Core namespace
• Inspect web server access logs for repeated requests to pages that trigger Permission, Cache, or Search deserialization following suspicious write operations
• Enable PHP auto_prepend_file instrumentation in non-production environments to log every unserialize() invocation and its input length

Monitoring Recommendations

• Alert on PHP-FPM or Apache child processes spawning shells, php -r, or outbound connections originating from the Concrete CMS web root
• Forward web server, PHP error, and database audit logs to a centralized analytics platform for correlation across write and read events
• Track file integrity on the Concrete CMS application directory to detect attacker-written webshells or modified configuration files

How to Mitigate CVE-2026-10721

Immediate Actions Required

• Upgrade Concrete CMS to version 9.5.2 or later on all production and staging instances
• Restrict database write access to the Concrete CMS schema using least-privilege accounts and review recent writes to Permission, Cache, and Search tables
• Rotate credentials for administrative accounts and database users if compromise is suspected

Patch Information

Concrete CMS resolved CVE-2026-10721 in release 9.5.2. Refer to the ConcreteCMS 9.5.2 Release Notes for upgrade instructions and the complete list of fixes.

Workarounds

• If immediate patching is not possible, restrict network access to the Concrete CMS administrative interface and database to trusted hosts only
• Clear the Concrete CMS cache after upgrading to remove any pre-existing serialized payloads stored in cache tables
• Review and purge unexpected entries from Permission, Cache, and Search tables before bringing the upgraded instance back online

# Configuration example: identify suspicious serialized payloads in MySQL
mysql -u concrete -p concrete5 -e \
  "SELECT id, LEFT(value, 200) FROM Config WHERE value LIKE 'O:%:\"%\":%';"