Is there a patch available for CVE-2026-8340?

Yes, a patch is available for CVE-2026-8340. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8340

Q: What is the CVSS score of CVE-2026-8340?

CVE-2026-8340 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31441 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-22 ConcreteCMS

GHSA-xjg6-5v39-v7fc

CSRF Concrete Cms

2.3

CVSS 4.0 · Vendor: ConcreteCMS

Severity by source

Vendor (ConcreteCMS) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Attacker needs no privileges; victim interaction is mandatory; impact is integrity-only and scoped to file version approval with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ConcreteCMS).

CVSS VectorVendor: ConcreteCMS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:26 vuln.today

CVE Published

May 22, 2026 - 13:58 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents permission is CSRF'd into publishing an attacker-chosen previously-uploaded version (downgrade to an older version of a file, or activation of a co-editor's unpublished version). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

AnalysisAI

CSRF in Concrete CMS 9.5.0 and below enables a network-based attacker to trick an authenticated backend editor into silently approving an unintended file version via the Backend\File::approveVersion endpoint, effectively downgrading a published file or activating an unpublished co-editor version without the victim's knowledge. Exploitation is constrained to users holding the edit_file_contents permission who can be socially engineered into visiting an attacker-controlled page while logged in. No public exploit code exists and no active exploitation has been identified; EPSS at 0.02% and SSVC Exploitation:none confirm minimal real-world urgency. Vendor patch available in version 9.5.1.

Technical ContextAI

Concrete CMS is a PHP-based open-source content management system. The vulnerable code path is the Backend\File::approveVersion action, which handles state-changing file version promotion within the CMS asset management workflow. CWE-352 (Cross-Site Request Forgery) identifies the root cause: the endpoint does not enforce anti-CSRF token validation on version approval requests, allowing a browser to be coerced into submitting a forged state-change on behalf of an authenticated user. The CPE cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* confirms the flaw spans the entire product line through 9.5.0. The CVSS 4.0 AT:P metric captures the secondary precondition that the attacker must possess or be able to reference a valid file version identifier on the target instance.

RemediationAI

Upgrade Concrete CMS to version 9.5.1 or later, which resolves the CSRF vulnerability in Backend\File::approveVersion per vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. If immediate upgrade is not feasible, reduce the attack surface by auditing and minimizing which users hold the edit_file_contents permission, since the permission is a prerequisite for exploitation - this limits the viable victim pool but may impact editorial workflows. Additionally, enforce security-awareness guidance for backend users to avoid clicking unsolicited links while authenticated to the CMS. Note that permission restriction is a compensating control only and does not eliminate the underlying CSRF flaw; upgrading remains the definitive fix.