CVE-2026-8134— Concrete CMS 安全漏洞

Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader's extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code execution. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 9.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H   Thanks Yonatan Drori (Tenzai) for reporting.

N/A

PHP程序中Include/Require语句包含文件控制不恰当(PHP远程文件包含)

Concrete CMS 安全漏洞

Concrete CMS是Concrete CMS开源的一个面向团队的开源内容管理系统。 Concrete CMS 9.5.0及之前版本存在安全漏洞，该漏洞源于在保存页面类型编辑器表单布局时，未对ptComposerFormLayoutSetControlCustomTemplate字段中的路径遍历序列进行清理，可能导致经过身份验证的恶意管理员利用此漏洞包含服务器上的任意可读文件，结合文件上传器的扩展名验证，可能导致经过身份验证的远程代码执行。

N/A

N/A