9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8134

CVE-2026-8134: Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion

Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader's extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code execution. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 9.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Thanks Yonatan Drori (Tenzai) for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8134

CVE-2026-8134:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a relative path traversal in Concrete CMS versions 9.5.0 and below. The vulnerability exists in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. The analysis of the security patch f22b9dff59454391a50a255a39995bf635deea9e for version 9.5.1 reveals the exact location of the vulnerability.

The file concrete/controllers/backend/page/type/composer/form/edit_control/save.php contains the vulnerable code. Specifically, the getPostedTemplate method within the Concrete\Controller\Backend\Page\Type\Composer\Form\EditControl\Save class was not properly sanitizing the user-provided template path. The original code only used a generic string sanitization function, which was not sufficient to prevent path traversal sequences like ../.

The patch introduces a check to ensure that the template provided by the user exists in a predefined list of allowed templates. This prevents an attacker from supplying an arbitrary path.

The save method in the same class calls getPostedTemplate and uses its return value, making it a key part of the exploitation chain. Therefore, both getPostedTemplate and save are identified as the vulnerable functions that would appear in a runtime profile during exploitation.

Vulnerable functions

Concrete\Controller\Backend\Page\Type\Composer\Form\EditControl\Save::getPostedTemplate

concrete/controllers/backend/page/type/composer/form/edit_control/save.php

The function `getPostedTemplate` is vulnerable to path traversal. It retrieves the `ptComposerFormLayoutSetControlCustomTemplate` parameter from the request and, before the patch, only performed a basic string sanitization. This was insufficient to prevent path traversal attacks. An attacker could provide a crafted path to include arbitrary files. The patch fixes this by validating the provided template against a list of available templates, ensuring that only valid templates can be used.

Concrete\Controller\Backend\Page\Type\Composer\Form\EditControl\Save::save

concrete/controllers/backend/page/type/composer/form/edit_control/save.php

The `save` method utilizes the value returned by the vulnerable `getPostedTemplate` function. While the core vulnerability is in `getPostedTemplate`, the `save` method is the entry point for the vulnerable logic that processes and persists the malicious input. An attacker would trigger this method to exploit the path traversal vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.