VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/8xxx/CVE-2026-8135.json
T

179 lines
8.7 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-8135",
"assignerOrgId": "ff5b8ace-8b95-4078-9743-eac1ca5451de",
"state": "PUBLISHED",
"assignerShortName": "ConcreteCMS",
"dateReserved": "2026-05-07T17:54:13.820Z",
"datePublished": "2026-05-21T20:16:39.866Z",
"dateUpdated": "2026-05-22T12:14:52.431Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "ff5b8ace-8b95-4078-9743-eac1ca5451de",
"shortName": "ConcreteCMS",
"dateUpdated": "2026-05-21T20:16:39.866Z"
},
"title": "Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller.",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of untrusted data",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-116",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-116 Excavation"
}
]
},
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"affected": [
{
"vendor": "Concrete CMS",
"product": "Concrete CMS",
"collectionURL": "https://github.com/concretecms/concretecms",
"repo": "https://github.com/concretecms/concretecms",
"versions": [
{
"status": "affected",
"version": "5.0",
"lessThanOrEqual": "9.5.0",
"versionType": "git"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rogue administrator with privileges to add blocks to an area can bypass the intended protection mechanism (_fromCIF === true), which normally restricts malicious inputs over form POST requests, by leveraging the REST API functionality. Because the REST API parses requests using json_decode(), the string \"true\" is evaluated as a strict PHP Boolean(true).  This bypass allows the attacker to inject a malicious serialized payload  into the block's filterFields database column. The payload will subsequently be executed when the block's data is viewed or edited by an administrator leading to complete server takeover (RCE).The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with a vector of CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H.  Thanks Nguyễn Văn Thiện https://github.com/Thien225409  for reporting",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the&nbsp;<code>ExpressEntryList</code>&nbsp;block controller. An rogue administrator with privileges to add blocks to an area can bypass the intended protection mechanism (<code>_fromCIF === true</code>), which normally restricts malicious inputs over form POST requests, by leveraging the REST API functionality. Because the REST API parses requests using <code>json_decode()</code>, the string <code>\"true\"</code> is evaluated as a strict PHP <code>Boolean(true)</code>.&nbsp; This bypass allows the attacker to inject a malicious serialized payload &nbsp;into the block's <code>filterFields</code> database column. The payload will subsequently be executed when the block's data is viewed or edited by an administrator leading to complete server takeover (RCE).The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with a vector of&nbsp;CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H.&nbsp; Thanks <a href=\"https://github.com/Thien225409\">Nguyễn Văn Thiện</a>&nbsp;for reporting&nbsp;"
}
]
}
],
"references": [
{
"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes",
"tags": [
"release-notes"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.9,
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
}
}
],
"credits": [
{
"lang": "en",
"value": "Nguyễn Văn Thiện",
"type": "finder"
}
],
"source": {
"defect": [
"HackerOne"
],
"advisory": "https://hackerone.com/reports/3643372",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-05-22T12:14:43.741857Z",
"id": "CVE-2026-8135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-05-22T12:14:52.431Z"
}
}
]
}
}
View Git Blame Copy Permalink