Is CVE-2026-30662 actively exploited?

No active exploitation of CVE-2026-30662 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-30662 be exploited remotely?

Yes. CVE-2026-30662 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-30662?

CVE-2026-30662 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-30662

MEDIUM

CVE-2026-30662

CWE-400Published: March 24, 2026· Updated: Mar 24, 2026

6.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.9th

Official Description

ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager component. The 'download' method in 'concrete/controllers/backend/file.php' improperly manages memory when creating zip archives. It uses 'ZipArchive::addFromString' combined with 'file_get_contents', which loads the entire content of every selected file into PHP memory. An authenticated attacker can exploit this by requesting a bulk download of large files, triggering an Out-Of-Memory (OOM) condition that causes the PHP-FPM process to terminate (SIGSEGV) and the web server to return a 500 error.

NVD Source

Technical Analysis

CVE-2026-30662 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 6.5.