Concrete CMS below version 9.4.8 can be manipulated by an authenticated administrator to store attacker‑controlled serialized data in the Express Entry List block configuration. The block later passes this data to PHP’s unserialize() without class restrictions or integrity checks, allowing an attacker to execute arbitrary code on the web server. The vulnerability is a stored PHP object injection, identified as CWE‑502, and grants full control of the compromised system.

All installations of Concrete CMS using versions older than 9.4.8 are affected. The vulnerability specifically targets the Express Entry List block component in those releases.

The CVSS v4.0 score of 8.9 indicates a high‑severity flaw; however, the EPSS score of less than 1% suggests it is currently not widely exploited. The vulnerability is not listed in the CISA KEV catalog. Exploitation is remote but requires authenticated administrative access to store malicious serialized payloads. Once executed, the attacker can run arbitrary code with the permissions of the web process, leading to complete system compromise.