CVE-2021-36766: Concretecms Concrete CMS

High severity, CVSS 7.2. EPSS: 3.7% chance of exploitation in the next 30 days.

Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/single_page/dashboard/system/environment/logging.php Logging::update_logging() method. User input passed through the logFile request parameter is not properly sanitized before being used in a call to the file_exists() PHP function. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection via phar:// stream wrapper), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code.

Affected products

• Concretecms Concrete CMS: before 8.5.6 (fixed in 8.5.6)

Published 2021-07-30. Last modified 2026-06-17.