CVE-2026-8134 in Concrete
Summary
by MITRE • 05/22/2026
Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader's extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code execution. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 9.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Thanks Yonatan Drori (Tenzai) for reporting.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/22/2026
This vulnerability exists within Concrete CMS versions 9.5.0 and earlier, specifically in the page type composer form layout functionality where insufficient input validation allows malicious path traversal sequences to be processed. The flaw resides in the ptComposerFormLayoutSetControlCustomTemplate field handling during page type composer form layout saving operations, creating a direct path traversal condition that enables unauthorized file access. The vulnerability requires an authenticated administrator with composer form editing privileges to exploit, making it a privilege escalation issue rather than a direct remote code execution vector. The security implications are severe because the system fails to properly sanitize user-supplied paths, allowing attackers to traverse the filesystem and access arbitrary readable files on the server. This represents a classic path traversal vulnerability that falls under CWE-22, specifically the "Path Traversal" category, where insufficient input validation allows attackers to access files outside the intended directory.
The operational impact becomes particularly dangerous when combined with Concrete CMS's file upload validation mechanism that only checks file extensions rather than content, permitting PHP code to be embedded within files with image extensions such as .png. This dual vulnerability creates a complete remote code execution chain where an attacker can first traverse the filesystem to include malicious files and then upload PHP code disguised as image files. The CVSS v4.0 score of 9.4 reflects the high severity of this combination, with a vector indicating network access required, low attack complexity, no user interaction needed, and high impact across all security metrics. The vulnerability demonstrates poor input sanitization practices and inadequate security controls in the file handling and validation processes, creating a dangerous attack surface for authenticated users. The attacker can leverage this to execute arbitrary code on the server, potentially leading to complete system compromise and data exfiltration.
The recommended mitigations include implementing proper input validation and sanitization for all user-supplied paths, particularly in file handling operations. Concrete CMS administrators should immediately upgrade to version 9.5.1 or later where this vulnerability has been patched. The system should enforce strict path validation that prevents traversal sequences from being processed, ensuring that all file operations occur within designated safe directories. Additionally, the file upload validation mechanism should be enhanced to check file content rather than relying solely on extensions, implementing content-based file type verification. Organizations should also implement network segmentation and access controls to limit the impact of potential compromise, ensuring that only trusted administrators have access to composer form editing capabilities. The vulnerability highlights the importance of following security best practices such as the principle of least privilege and defense in depth, where multiple layers of security controls work together to prevent exploitation. This incident underscores the critical need for regular security audits and proper input validation in web applications, particularly those handling user-provided data in file operations.