Concrete CMS version 9.5.0 and earlier contain an insecure deserialization flaw in the ExpressEntryList block controller that allows a rogue administrator to inject a malicious serialized payload. By abusing the REST API, which parses input with json_decode, the defensive check for a verified CIF flag can be bypassed when the JSON field is the string “true”. The attacker places this payload in the block’s filterFields column, and the payload is executed whenever an administrator views or edits the block, resulting in complete server takeover.

All installations of Concrete CMS 9.5.0 and any earlier releases are affected. Products to monitor include the official Concrete CMS platform; no specific third‑party variants are listed. The vulnerability is tied to the ExpressEntryList block functionality present in these versions.

The flaw carries a CVSS v4.0 score of 8.9, indicating a high‑severity risk. Attackers must have administrative privileges that permit adding blocks, but the REST API provides a network‑based entry that can be used by anyone with those rights. Because the payload is executed at the time an administrator interacts with the block, exploitation can lead to full remote code execution. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalogue, but the high CVSS rating and the necessity for elevated privileges underscore the importance of addressing it promptly.