We are happy to announce Concrete CMS 9.5.2. This is a focused release: a security fix worth paying attention to, a handful of bug fixes, and one quality of life improvement for editors. We recommend that site administrators update to 9.5.2 to ensure their site remains secure.
Announcing Concrete CMS 9.5.2 Release
Jun 3, 2026
by
On the security side, two PHP Object Injection vulnerabilities have been closed. Both were responsibly reported through our HackerOne program and are fixed in this release. Third party dependencies including twig/twig and symfony/yaml have also been updated to pull in upstream security patches.
On the bug fix side, advanced board templates using the $summaryObject variable are working again, and blocks with missing custom templates now fall back to their default view instead of rendering nothing. Small things, but annoying if you hit them.
The one improvement worth noting for site builders: page attributes are now grouped by set in the Composer Add Form Control dialog, which makes that panel a lot easier to navigate on sites with many attributes.
The full release notes have the complete details.
Image Source:
Maslowski, S. (n.d.). Indigo bunting [Photograph]. U.S. Fish and Wildlife Service. Public domain. https://www.fws.gov/media/ingigo-bunting