CVE-2026-30662

ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager component. The 'download' method in 'concrete/controllers/backend/file.php' improperly manages memory when creating zip archives. It uses 'ZipArchive::addFromString' combined with 'file_get_contents', which loads the entire content of every selected file into PHP memory. An authenticated attacker can exploit this by requesting a bulk download of large files, triggering an Out-Of-Memory (OOM) condition that causes the PHP-FPM process to terminate (SIGSEGV) and the web server to return a 500 error.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://wang1rrr.github.io/2026/02/11/CVE-Report-ConcreteCMS-DoS/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:concretecms:concrete_cms:9.4.7:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-24 15:16

Updated : 2026-03-24 20:16

NVD link : CVE-2026-30662

Mitre link : CVE-2026-30662

CVE.ORG link : CVE-2026-30662

JSON object : View

Products Affected

concretecms

concrete_cms

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-30662", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2026-03-24T15:16:34.457", "references": [{"url": "https://wang1rrr.github.io/2026/02/11/CVE-Report-ConcreteCMS-DoS/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager component. The 'download' method in 'concrete/controllers/backend/file.php' improperly manages memory when creating zip archives. It uses 'ZipArchive::addFromString' combined with 'file_get_contents', which loads the entire content of every selected file into PHP memory. An authenticated attacker can exploit this by requesting a bulk download of large files, triggering an Out-Of-Memory (OOM) condition that causes the PHP-FPM process to terminate (SIGSEGV) and the web server to return a 500 error."}, {"lang": "es", "value": "ConcreteCMS v9.4.7 contiene una vulnerabilidad de denegaci\u00f3n de servicio (DoS) en el componente del Administrador de Archivos. El m\u00e9todo 'download' en 'concrete/controllers/backend/file.php' gestiona incorrectamente la memoria al crear archivos zip. Utiliza 'ZipArchive::addFromString' combinado con 'file_get_contents', lo que carga el contenido completo de cada archivo seleccionado en la memoria PHP. Un atacante autenticado puede explotar esto solicitando una descarga masiva de archivos grandes, lo que desencadena una condici\u00f3n de Out-Of-Memory (OOM) que provoca la terminaci\u00f3n del proceso PHP-FPM (SIGSEGV) y que el servidor web devuelva un error 500."}], "lastModified": "2026-03-24T20:16:27.010", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:concretecms:concrete_cms:9.4.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF06110B-22B0-44D9-951B-BBB115E0968D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}