CVE-2026-8135

Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rogue administrator with privileges to add blocks to an area can bypass the intended protection mechanism (_fromCIF === true), which normally restricts malicious inputs over form POST requests, by leveraging the REST API functionality. Because the REST API parses requests using json_decode(), the string "true" is evaluated as a strict PHP Boolean(true).  This bypass allows the attacker to inject a malicious serialized payload  into the block's filterFields database column. The payload will subsequently be executed when the block's data is viewed or edited by an administrator leading to complete server takeover (RCE).The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with a vector of CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H.  Thanks Nguyễn Văn Thiện https://github.com/Thien225409  for reporting

• CWE-502

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notesRelease Notes

Published

May 21, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81341wolfEngine before 1.4.1 sources the explicit AES-CCM nonce f…6.5
• CVE-2026-81342The MasterStudy LMS WordPress Plugin WordPress plugin befor…4.7
• CVE-2026-81346The Frontend Admin by DynamiApps WordPress plugin before 3.2…4.3
• CVE-2026-81347The Frontend Admin by DynamiApps WordPress plugin before 3.2…5.9
• CVE-2026-81348The My Private Site WordPress plugin before 4.2.3 does not …3.7
• CVE-2026-81349Improper neutralization of special elements used in an os co…7.2
• CVE-2026-81352Heap-based buffer overflow in Microsoft Windows Codecs Libra…9.8
• CVE-2026-81353Heap-based buffer overflow in Microsoft Windows Codecs Libra…7.8
• CVE-2026-81354Heap-based buffer overflow in Windows Hello allows an author…8.2
• CVE-2026-81355Heap-based buffer overflow in Virtual Hard Disk (VHD) Minipo…7.8
• CVE-2026-81356Inconsistent interpretation of http requests ('http request/…8.2
• CVE-2026-81357Server-side request forgery (ssrf) in Visual Studio Code all…8.2