Concrete CMS versions below 9.5.2 are susceptible to PHP Object Injection through unintended unserialize calls in the Permission, Cache, and Search components. When a maliciously crafted serialized payload is stored in the database, an unauthenticated attacker can trigger arbitrary PHP object instantiation. This vulnerability aligns with the CWE‑502 weakness of insecure deserialization and can potentially lead to remote code execution.

Affected products include Concrete CMS running any release earlier than 9.5.2. The vulnerability specifically targets functionality within the Permission, Cache, and Search modules, requiring that the attacker be able to place a malicious serialized object in the database.

The CVSS base score of 8.4 indicates a high severity, although the EPSS score is unavailable and the flaw is not yet flagged in CISA’s KEV catalog. Based on the description, the attack vector is likely data injection into the database, requiring the attacker to have write access or exploit a feature that allows arbitrary data storage. Successful exploitation would enable an attacker to instantiate arbitrary PHP objects, effectively achieving remote code execution with the privileges of the web application.