VULNERABILITY INTELLIGENCE

CVE-2021-40097

CVSS score8.8 HIGH

EPSS probability2.50%

CISA KEVNot currently listed

Published2021-09-27

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in Concrete CMS through 8.5.5. Authenticated path traversal leads to to remote code execution via uploaded PHP code, related to the bFilename parameter.

Weakness classification

nvd@nist.gov: CWE-22

Primary references

cve@mitre.org — Release Notes, Vendor Advisory
cve@mitre.org — Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Third Party Advisory