Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-8134

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader's extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code executio
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:7b5b64607fd0f797da865b1a3c09e3ff27143b33dc3169badebd0a9b8f838eac
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 3 assertions

{"cweId":"CWE-23","description":"CWE-23 Relative path traversal","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ebce10a3851e6047f5cb5fab55e89809121d4da35b67de7289aa623336f3589e · sha256:177cc43f497bbd0a… · /containers/cna/problemTypes/2/descriptions/0

{"cweId":"CWE-98","description":"CWE-98 Improper control of filename for Include/Require statement in PHP program ('PHP remote file inclusion')","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ebce10a3851e6047f5cb5fab55e89809121d4da35b67de7289aa623336f3589e · sha256:177cc43f497bbd0a… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-434","description":"CWE-434 Unrestricted upload of file with dangerous type","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ebce10a3851e6047f5cb5fab55e89809121d4da35b67de7289aa623336f3589e · sha256:177cc43f497bbd0a… · /containers/cna/problemTypes/1/descriptions/0

Affected products and versions

1 source assertion
{"collectionURL":"https://github.com/concretecms/concretecms","defaultStatus":"unaffected","product":"Concrete CMS","programFiles":["https://github.com/concretecms/concretecms"],"repo":"https://github.com/concretecms/concretecms","vendor":"Concrete CMS","versions":[{"lessThanOrEqual":"9.5.0","status":"affected","version":"5.0","versionType":"git"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:ebce10a3851e6047f5cb5fab55e89809121d4da35b67de7289aa623336f3589e · sha256:177cc43f497bbd0a… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.4,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpac…
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:ebce10a3851e6047f5cb5fab55e89809121d4da35b67de7289aa623336f3589e · sha256:177cc43f497bbd0a… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

3 source assertions
{"cweId":"CWE-23","description":"CWE-23 Relative path traversal","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ebce10a3851e6047f5cb5fab55e89809121d4da35b67de7289aa623336f3589e · sha256:177cc43f497bbd0a… · /containers/cna/problemTypes/2/descriptions/0
{"cweId":"CWE-98","description":"CWE-98 Improper control of filename for Include/Require statement in PHP program ('PHP remote file inclusion')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ebce10a3851e6047f5cb5fab55e89809121d4da35b67de7289aa623336f3589e · sha256:177cc43f497bbd0a… · /containers/cna/problemTypes/0/descriptions/0
{"cweId":"CWE-434","description":"CWE-434 Unrestricted upload of file with dangerous type","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ebce10a3851e6047f5cb5fab55e89809121d4da35b67de7289aa623336f3589e · sha256:177cc43f497bbd0a… · /containers/cna/problemTypes/1/descriptions/0

Source references

1 source assertion
{"tags":["release-notes"],"url":"https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ebce10a3851e6047f5cb5fab55e89809121d4da35b67de7289aa623336f3589e · sha256:177cc43f497bbd0a… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer