CVE-2026-30662 Overview
ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager component. The download method in concrete/controllers/backend/file.php improperly manages memory when creating zip archives. It uses ZipArchive::addFromString combined with file_get_contents, which loads the entire content of every selected file into PHP memory. An authenticated attacker can exploit this by requesting a bulk download of large files, triggering an Out-Of-Memory (OOM) condition that causes the PHP-FPM process to terminate (SIGSEGV) and the web server to return a 500 error.
Critical Impact
Authenticated attackers can cause complete service disruption by triggering memory exhaustion, resulting in PHP-FPM crashes and web server unavailability.
Affected Products
- ConcreteCMS Concrete CMS version 9.4.7
Discovery Timeline
- 2026-03-24 - CVE CVE-2026-30662 published to NVD
- 2026-03-24 - Last updated in NVD database
Technical Details for CVE-2026-30662
Vulnerability Analysis
This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), representing a memory exhaustion condition that can be triggered by authenticated users. The flaw exists in the File Manager component's bulk download functionality, specifically within the download method implementation.
The vulnerable code path allows any authenticated user with file download permissions to request multiple large files simultaneously for bulk download. Rather than streaming the file contents efficiently, the application loads the entire contents of each selected file into PHP's working memory using file_get_contents. This data is then passed to ZipArchive::addFromString for archive creation.
When processing requests involving large files or numerous smaller files, the cumulative memory allocation can exceed PHP's configured memory limits, leading to an unrecoverable Out-Of-Memory condition. This causes the PHP-FPM worker process to crash with a segmentation fault (SIGSEGV), resulting in a 500 Internal Server Error for end users.
Root Cause
The root cause is improper memory management in the zip archive creation process. The application uses an inefficient pattern that loads complete file contents into memory rather than utilizing streaming or chunked processing methods. The file_get_contents function reads entire files into memory, and when combined with ZipArchive::addFromString, this creates a scenario where memory consumption scales linearly with the total size of selected files.
PHP applications are particularly susceptible to this issue because the language's memory management requires developers to explicitly consider resource constraints. The lack of chunked file processing or memory-efficient streaming methods in the File Manager's download implementation creates this exploitable condition.
Attack Vector
The attack can be executed remotely over the network by any authenticated user with access to the File Manager component. The exploitation requires low complexity—an attacker simply needs to select multiple large files (or a significant number of files) and initiate a bulk download request.
The attack flow involves:
- Authenticating to the ConcreteCMS administrative interface
- Navigating to the File Manager component
- Selecting multiple large files for bulk download
- Initiating the download request, which triggers the memory-intensive zip creation process
- The server's PHP-FPM process exhausts available memory and crashes
No user interaction beyond the attacker's own actions is required, and the attack can be repeated to maintain service disruption.
Detection Methods for CVE-2026-30662
Indicators of Compromise
- PHP-FPM error logs showing SIGSEGV crashes or memory allocation failures
- Web server access logs containing multiple bulk download requests to the File Manager endpoint from the same authenticated session
- System logs indicating OOM killer activation targeting PHP-FPM processes
- Sudden spikes in memory usage correlated with File Manager activity
Detection Strategies
- Monitor PHP-FPM process health and restart frequency for unusual patterns
- Implement application-layer logging to track bulk download requests by authenticated users
- Configure alerting on HTTP 500 errors originating from File Manager endpoints
- Analyze access patterns for users making unusually large or frequent file download requests
Monitoring Recommendations
- Set up memory usage alerts for PHP-FPM worker processes with thresholds below critical levels
- Enable verbose error logging in PHP to capture memory exhaustion events before crashes
- Implement real-time monitoring of web server error rates to detect service disruptions
- Create dashboards tracking File Manager endpoint response times and error codes
How to Mitigate CVE-2026-30662
Immediate Actions Required
- Restrict File Manager access to only trusted administrative users
- Implement file size limits for bulk download operations at the application or web server level
- Consider disabling the bulk download feature until a patch is available
- Configure PHP memory limits and execution timeouts to fail gracefully rather than crash
Patch Information
As of the last NVD update on 2026-03-24, check the ConcreteCMS security advisory for detailed vulnerability information and monitor official ConcreteCMS channels for patch releases addressing this vulnerability. Upgrade to the latest available version when a security update is released.
Workarounds
- Implement web application firewall (WAF) rules to limit the number of files that can be requested in a single bulk download operation
- Configure PHP's memory_limit directive to a lower value to trigger controlled failures rather than SIGSEGV crashes
- Use web server configuration to impose request size limits on File Manager endpoints
- Restrict authenticated user permissions to prevent access to the bulk download functionality
# PHP configuration example to limit memory and improve crash handling
# Add to php.ini or php-fpm pool configuration
memory_limit = 256M
max_execution_time = 30
post_max_size = 100M
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
