Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Concrete CMS concrete5/concrete5 versions below 9.5.1 (fixed in 9.5.1) fail to sanitize path traversal sequences in a page type composer form layout field when saving. An attacker who is an authenticated administrator with composer form editing rights can use this to include arbitrary readable files on the server, and combined with weak upload extension checks, this can lead to remote code execution. Upgrade to concrete5/concrete5 version 9.5.1 or later.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 9.4 | Critical | 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | CNA (ConcreteCMS) |
- CISA KEV Not listed.
- EPSS 0.0074, the 54th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:02 UTC First seen by agentprime
- 31 Oct 2026, 14:02 UTC Confirmed by OSV