ConcreteCMS version 9.4.7 contains a denial‑of‑service vulnerability in the File Manager’s bulk download function. The controller uses ZipArchive::addFromString combined with file_get_contents, loading each selected file into PHP memory; this flaw is identified as a CWE‑400 memory management weakness. When an attacker selects large files for download, PHP‑FPM exhausts memory, crashes with a SIGSEGV, and the web server returns a 500 error, disrupting service for all users.

Only the 9.4.7 release of ConcreteCMS that has the File Manager bulk‑download feature enabled is affected. The issue resides in concrete/controllers/backend/file.php and does not apply to newer releases where the zip creation process has been patched or constrained.

The CVSS score of 6.5 signals a medium severity. No EPSS score is available and the flaw is not yet recorded in CISA’s KEV catalog. Exploitation requires authenticated access; an attacker who can log in to the CMS can trigger the OOM by initiating a bulk download of large files. The attack does not compromise confidentiality or integrity, but it can cause temporary availability outages until the PHP process restarts or the server is recovered.