# Concretecms Concrete Cms


- [CVE-2023-48648](https://insights.sbomify.com/CVE-2023-48648/): Concrete CMS allows unauthorized access because directories can be created with insecure permissions (critical 9.8)
- [CVE-2022-21829](https://insights.sbomify.com/CVE-2022-21829/): Code injection in concrete CMS (critical 9.8)
- [CVE-2021-22958](https://insights.sbomify.com/CVE-2021-22958/): Server-Side Request Forgery vulnerability in concrete5 (critical 9.8)
- [CVE-2021-40098](https://insights.sbomify.com/CVE-2021-40098/): Path traversal in n/a (critical 9.8)
- [CVE-2026-8134](https://insights.sbomify.com/CVE-2026-8134/): Concrete CMS Vulnerable to Relative Path Traversal (critical 9.4)
- [CVE-2022-30117](https://insights.sbomify.com/CVE-2022-30117/): Path traversal in Concrete CMS (critical 9.1)
- [CVE-2021-40102](https://insights.sbomify.com/CVE-2021-40102/): Deserialization in n/a (critical 9.1)
- [CVE-2026-8135](https://insights.sbomify.com/CVE-2026-8135/): Concrete CMS Vulnerable to Deserialization of Untrusted Data (high 8.9)
- [CVE-2026-3452](https://insights.sbomify.com/CVE-2026-3452/): Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block. (high 8.9)
- [CVE-2022-43693](https://insights.sbomify.com/CVE-2022-43693/): Concrete CMS vulnerable to Cross-site Request Forgery (high 8.8)
- [CVE-2021-22954](https://insights.sbomify.com/CVE-2021-22954/): Cross Site Request Forgery in concrete5/concrete5 (high 8.8)
- [CVE-2021-22966](https://insights.sbomify.com/CVE-2021-22966/): Improper Privilege Management in Concrete CMS (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/concretecms/concrete-cms/