CVE-2026-8134

An authenticated administrator with permissions to edit composer forms can inject path traversal sequences (e.g., '../') into the ptComposerFormLayoutSetControlCustomTemplate field while saving form layouts on the page. This mechanism allows inclusion of any readable file on the server. Since the file uploader validates only the extension (not the actual content), an attacker can previously upload a file containing PHP code saved with a graphics extension (e.g., .png), and then force its inclusion through the vulnerable field – resulting in execution of malicious PHP code.

An attacker can read arbitrary files accessible to the web server process and execute arbitrary code on the server (RCE), which may lead to complete takeover of the system and the environment hosting the application.

Concrete CMS should be updated to version 9.5.1 or newer according to the vendor information available at: https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

Concrete CMS in version 9.5.0 and lower