CVE-2026-8417
Received Received - Intake
CSRF in Concrete CMS Package Update

Publication date: 2026-05-21

Last updated on: 2026-05-21

Assigner: ConcreteCMS

Description
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() method in concrete/controllers/single_page/dashboard/extend/update.php checks only canInstallPackages() before executing upgradeCoreData() and upgrade() on the named package's controller. Because the endpoint is a state-changing GET route with no token enforcement, an attacker can force an authenticated administrator to trigger a package upgrade via a single cross-site navigation.In order to be vulnerable, the victim must be passing canInstallPackages() and and a target package must already be already installed.Β The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score ofΒ 7.5 with vectorΒ CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. ThanksΒ  https://github.com/maru1009 Β for reporting.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-21
Last Modified
2026-05-21
Generated
2026-05-22
AI Q&A
2026-05-22
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms to 9.5.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability affects Concrete CMS version 9.5.0 and below. It occurs because the system does not validate a CSRF (Cross-Site Request Forgery) token before processing requests to the /dashboard/extend/update/do_update/&lt;pkgHandle&gt; endpoint.

The do_update() method checks only if the user can install packages (canInstallPackages()) before executing upgradeCoreData() and upgrade() on the specified package's controller. Since this endpoint is a state-changing GET route without token enforcement, an attacker can trick an authenticated administrator into triggering a package upgrade simply by making them visit a malicious link.

For the attack to succeed, the victim must have permission to install packages and the targeted package must already be installed.


How can this vulnerability impact me? :

This vulnerability can allow an attacker to force an authenticated administrator to unknowingly upgrade a package. This could lead to unauthorized changes in the system, potentially introducing malicious code or destabilizing the CMS.

Because the attack exploits a state-changing GET request without proper CSRF protection, it can be triggered via a single cross-site navigation, making it easier for attackers to exploit.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart