Which versions of Concrete CMS are affected by CVE-2026-8140?

Concrete CMS 9.5.0 and earlier contains a cross-site request forgery vulnerability in the marketplace extension installer that could enable attackers to trick authenticated administrators into…. A patch is available.

How to fix or mitigate CVE-2026-8140?

Within 24 hours: Identify all Concrete CMS installations running 9.5.0 or earlier and restrict administrative dashboard access to known internal IP addresses. Within 7 days: Audit marketplace packages installed in the past 90 days, review administrator activity logs, and implement CSRF protections via WAF or reverse proxy. Within 30 days: Monitor vendor advisories for patch release and establish upgrade timeline; if patch remains unavailable, implement multi-factor authentication for all administrators and disable marketplace installation for non-essential roles.

Concrete CMS CVE-2026-8140

Q: What is the CVSS score of CVE-2026-8140?

CVE-2026-8140 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31338 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ff5b8ace-8b95-4078-9743-eac1ca5451de

GHSA-r42c-3rr2-jrfp

PHP CSRF

7.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 21:32 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method in concrete/controllers/single_page/dashboard/extend/install.php checks only the canInstallPackages() permission before fetching a remote marketplace package and writing it to the server's DIR_PACKAGES directory. Because the endpoint is a state-changing GET route with no token enforcement, an attacker who can cause an authenticated administrator to visit a crafted page can force an arbitrary marketplace package to be downloaded. In order to be vulnerable, the victim must be passing canInstallPackages() and the site must be connected to the Concrete marketplace. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.

AnalysisAI

Cross-site request forgery in Concrete CMS 9.5.0 and earlier allows remote attackers to coerce authenticated administrators into downloading arbitrary marketplace packages to the server's DIR_PACKAGES directory by luring them to a crafted page that triggers the unprotected /dashboard/extend/install/download/<remoteId> GET endpoint. The vendor assigned CVSS 4.0 of 7.5 reflecting high impact on confidentiality, integrity, and availability, though no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

Concrete CMS is an open-source PHP content management system whose dashboard exposes a marketplace integration for installing extension packages. The vulnerable code path lives in concrete/controllers/single_page/dashboard/extend/install.php, where the download() method gates access only via the canInstallPackages() permission check and then fetches a remote package by remoteId, writing the payload into DIR_PACKAGES on disk. This is a textbook CWE-352 (Cross-Site Request Forgery) issue compounded by the use of a state-changing GET route - an anti-pattern that makes the endpoint trivially triggerable from any third-party origin via image tags, links, or redirects, since browsers automatically attach session cookies regardless of the initiating origin.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later as indicated by the vendor release-notes reference (https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes); a released patched version is implied by the reference but the exact fixed build number was not independently confirmed in the provided data. Until upgrade is possible, restrict the canInstallPackages() permission to a minimal set of operators, disconnect the site from the Concrete marketplace to neutralize the remote fetch path (at the cost of losing in-dashboard package discovery and one-click installs), and block external access to /dashboard/extend/install/download/ at the reverse proxy or WAF layer. Administrators should also adopt strict same-site session cookies and avoid browsing untrusted content while authenticated to the CMS dashboard.