CVE-2026-8135

Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rogue administrator with privileges to add blocks to an area can bypass the intended protection mechanism (_fromCIF === true), which normally restricts malicious inputs over form POST requests, by leveraging the REST API functionality. Because the REST API parses requests using json_decode(), the string "true" is evaluated as a strict PHP Boolean(true).  This bypass allows the attacker to inject a malicious serialized payload  into the block's filterFields database column. The payload will subsequently be executed when the block's data is viewed or edited by an administrator leading to complete server takeover (RCE).The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with a vector of CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H.  Thanks Nguyễn Văn Thiện https://github.com/Thien225409  for reporting

• CWE-502

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notesRelease Notes

Published

May 21, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8129A vulnerability was determined in SourceCodester SUP Online …7.3
• CVE-2026-8130A vulnerability was identified in SourceCodester SUP Online …7.3
• CVE-2026-8131A security flaw has been discovered in SourceCodester SUP On…7.3
• CVE-2026-8132A weakness has been identified in CodeAstro Leave Management…7.3
• CVE-2026-8133A security vulnerability has been detected in zyx0814 FilePr…7.3
• CVE-2026-8134Concrete CMS 9.5.0 and below fails to sanitize path traversa…7.2
• CVE-2026-8136A flaw has been found in SourceCodester Pharmacy Sales and I…2.4
• CVE-2026-8137A vulnerability has been found in Totolink X5000R 9.1.0u.636…8.8
• CVE-2026-8138A vulnerability was found in Tenda CX12L 16.03.53.12. This i…8.8
• CVE-2026-8139Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via…5.4
• CVE-2026-8140Concrete CMS 9.5.0 and below does not validate a CSRF token …6.5
• CVE-2026-8141The Ajax Load More - Filters plugin for WordPress is vulnera…7.2