CVE-2026-8134 — Relative Path Traversal in Concrete CMS

Vendor	Product	Version range	Fixed in
concrete5	concrete5	>= 0 < 9.5.1	9.5.1
concrete_cms	concrete_cms	5.0 – 9.5.0	—
concretecms	concrete_cms	<= 9.5.0	—

GHSA

GHSA-645j-cm4x-3xvw: Concrete CMS 9

ghsa_unreviewed·2026-05-21

CVE-2026-8134 [CRITICAL] CWE-23 GHSA-645j-cm4x-3xvw: Concrete CMS 9 Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader's extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code execution. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 9.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Thanks Yonatan Drori (Tenzai) for reporting.

GHSA

Concrete CMS Vulnerable to Relative Path Traversal

ghsa·2026-05-21

CVE-2026-8134 [CRITICAL] CWE-23 Concrete CMS Vulnerable to Relative Path Traversal Concrete CMS Vulnerable to Relative Path Traversal Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader's extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code execution. Concrete CMS thanks Yonatan Drori (Tenzai) for reporting this issue.

VulDB

Concrete CMS up to 9.5.0 File Upload ptComposerFormLayoutSetControlCustomTemplate filename control (EUVD-2026-31335)

vuldb·2026-05-21·CVSS 9.4

CVE-2026-8134 [CRITICAL] Concrete CMS up to 9.5.0 File Upload ptComposerFormLayoutSetControlCustomTemplate filename control (EUVD-2026-31335) A vulnerability labeled as problematic has been found in Concrete CMS up to 9.5.0. The affected element is an unknown function of the component File Upload Handler. Executing a manipulation of the argument ptComposerFormLayoutSetControlCustomTemplate can lead to improper control of filename for include/require statement in php program ('php remote file inclusion'). The identification of this vulnerability is CVE-2026-8134. The attack may be launched remotely. There is no exploit available.

CVE-2026-8134: Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type…

Affected

CVSS provenance