GitHub Advisoryadvisory · Packagist

GHSA-fqg3-8w8r-8g94 Concrete CMS has an unauthorized file access issue

MEDIUM Published 2026-05-22 Modified 2026-07-21 Official page ↗
Aliases
CVE-2026-7879
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-862
Reviewed
2026-06-24

Affected packages

• Packagist concrete5/concrete5: < 9.5.1 → fixed in 9.5.1

Description

In Concrete CMS 9.5.0 and below,  the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading permission-restricted files bypasses the view_file permission check. Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file.

Related

Alias · CVE (1)

  • CVE-2026-7879 In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References