CVE-2026-8428
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view, but the do_update() method does not validate it. An attacker can exploit this to perform a CSRF attack that updates the CMS to an attacker-specified version.
Risk Assessment
The risk involves an attacker remotely controlling the CMS update process, potentially leading to installation of a malicious version and full system compromise.
Recommendation
Immediately update to version 9.5.1 or later, which includes proper CSRF token validation.
Other vulnerabilities in Concrete CMS
See all- CVE-2026-10721High
Vulnerability in Concrete CMS below version 9.5.2 allows an unauthenticated attacker to perform PHP object injection via unserialize() calls in Permission, Cache, and Search components. The attack requires a malicious payload to be placed in the database.
- CVE-2026-7888High
Concrete CMS below version 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database.
- CVE-2026-8353Medium
Concrete CMS versions 9.0 to 9.5.0 are vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes in the context of any authenticated user visiting the affected account pages.
- CVE-2026-8347Medium
Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity ordering.
- CVE-2026-8340Medium
Concrete CMS version 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. A victim with edit_file_contents permission can be tricked into publishing an attacker-chosen previously-uploaded file version (downgrade or activation of an unpublished version).
- CVE-2026-8435Medium
Concrete CMS 9 before version 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) in the approveVersion() controller. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of an administrator.
- CVE-2026-8434High
Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). An attacker can trick an administrator into performing unwanted file operations.
- CVE-2026-8433High
Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). An attacker can trick an administrator into rescanning a file.
- CVE-2026-8432High
Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). An attacker can trick an administrator into starring a file.
- CVE-2026-8427High
Concrete CMS 9 before 9.5.0 is vulnerable to CSRF in the removeFavoriteFolder($id) endpoint. An attacker can exploit this to perform unauthorized actions on behalf of the victim.
Original NVD description (English source)
Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method in concrete/controllers/single_page/dashboard/system/update/update.php never calls $this->token->validate('do_update'). The form is rendered as a POST form, meaning the token reaches the browser, but because the controller discards it without verification, an attacker can craft a cross-site POST that triggers a core CMS update to an attacker-specified version string. In order to be vulnerable, theictim must be passing canUpgrade()anda valid update version must be present under DIR_CORE_UPDATES. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.