GitHub Advisoryadvisory · Packagist

GHSA-66rg-92q4-6m8q Concrete CMS is vulnerable to unauthorized file deletion

LOW Published 2026-05-22 Modified 2026-06-24 Official page ↗
Aliases
CVE-2026-7882
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-352
Reviewed
2026-06-24

Affected packages

• Packagist concrete5/concrete5: < 9.5.1 → fixed in 9.5.1

Description

Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. The code throws an error when the token IS valid and proceeds with file deletion when the token is invalid or missing. This effectively disables CSRF protection for the file deletion endpoint, allowing cross-site request forgery attacks against users who have permission to edit conversation messages.

Related

Alias · CVE (1)

  • CVE-2026-7882 Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References