Concrete CMS CVE-2026-8236

The target must be running Concrete CMS version 9.5.0 or earlier with the /ccm/system/dialogs/file/usage/{fID} endpoint reachable over the network - no authentication is required (PR:N) and no victim interaction is needed (UI:N). The CVSS 4.0 AT:P (Attack Requirements: Present) metric indicates that exploitation is only meaningful when valid integer file IDs exist in the CMS file manager; requests against non-existent IDs return no useful disclosure, so an attacker must enumerate or guess valid IDs, which in practice is low-friction against default sequential ID assignment. Exploitation is strictly limited to low-confidentiality disclosure of internal page metadata - no integrity or availability impact is possible through this vector alone. Installations where all CMS URLs are gated behind an authenticated reverse proxy, SSO layer, or VPN are not exposed to unauthenticated remote exploitation regardless of CMS version.

The CVSS 4.0 score of 6.3 (Medium) reflects a balanced signal set. AV:N and PR:N confirm remote unauthenticated exploitability, and AC:L means no special technique is required, but two mitigating factors constrain real-world impact: AT:P (Attack Requirements: Present) indicates that specific conditions - specifically, valid and guessable file IDs - must exist for the attack to yield useful data, and the impact is bounded to VC:L (low confidentiality) with zero integrity or availability impact. The disclosed data is site topology metadata, not file content or credentials, meaning exploitation alone does not constitute a breach but does meaningfully lower the cost of follow-on reconnaissance. No EPSS data was provided in the input; no POC code is publicly identified; and no CISA KEV listing exists - all suggesting this has not been observed in broad exploitation campaigns. Overall, this is a genuine but moderate-priority finding: easily exploitable in technique but limited in direct harm, making it a good candidate for patch-cycle remediation rather than emergency response unless the site topology data would be particularly sensitive in context.

An unauthenticated attacker scripts sequential GET requests against https://target-site.example/ccm/system/dialogs/file/usage/1 through /ccm/system/dialogs/file/usage/500, iterating over plausible integer file IDs. Each response for a valid ID returns a list of page IDs, URL slugs, and version metadata revealing the site's content hierarchy, which the attacker uses to identify high-value pages, hidden drafts, or unpublished content paths for further targeted attacks. No public exploit code has been identified, but the technique requires only a basic HTTP client and knowledge of the endpoint pattern.