THREAT OPS › Threat News › [NVD] CVE-2026-7888 — Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize()
calls in the Workflow, Form block, and File/Set components that lack the
allowed_classes restriction. The Form block and File/Set sinks were addressed in
9.5.2; the Workflow component sinks were addr
[NVD] CVE-2026-7888 — Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. The Form block and File/Set sinks were addressed in 9.5.2; the Workflow component sinks were addr
CVE-2026-7888 CVSS: None Published: 2026-06-03T19:16:38.910
Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. The Form block and File/Set sinks were addressed in 9.5.2; the Workflow component sinks were addressed in 9.5.3. An unauthenticated attacker may trigger ar
Indicators of compromise
- CVE-2026-7888cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-7888