Concrete CMS Path Traversal Vulnerability Leading to Authenticated Remote Code Execution

A vulnerability in Concrete CMS versions through 9.5.0 allows for path traversal attacks via the ptComposerFormLayoutSetControlCustomTemplate field. This issue arises when saving page type composer form layouts, as the application fails to properly sanitize traversal sequences. An authenticated rogue administrator with rights to edit composer forms can exploit this flaw to include arbitrary readable files from the server. Furthermore, this vulnerability can be combined with the file uploader's extension-only validation, which mistakenly allows PHP code to be executed in files saved with image extensions like .png. This could result in authenticated remote code execution.

Impact

Exploitation of this vulnerability could lead to authenticated remote code execution on the server.

Remediation

Users can upgrade to Concrete CMS version 9.5.1 or later to address this vulnerability.