GitHub Advisoryadvisory · Packagist

GHSA-4c8m-6fwx-m7xq Concrete CMS contains a CSRF vulnerability

HIGH Published 2026-05-21 Modified 2026-06-24 Official page ↗
Aliases
CVE-2026-8421
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-352
Reviewed
2026-06-24

Affected packages

• Packagist concrete5/concrete5: < 9.5.1 → fixed in 9.5.1

Description

Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.  An attacker who can cause an authenticated administrator to visit a crafted page,  and who has placed or caused a package to be present under DIR_PACKAGES//, can force the installation of that package without any CSRF protection. Package installation executes the package controller's install() method as the web server user, enabling remote code execution.  In order to be vulnerable, the victim must be passing canInstallPackages. The Concrete CMS security team thanks @maru1009 for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-8421 Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References