Concrete CMS CVE-2026-8417

Victim must be an authenticated Concrete CMS user whose role passes the canInstallPackages() permission check (in practice, an administrator), AND the specific package handle targeted in the URL must already be installed on the victim site, AND the admin must perform user interaction by visiting attacker-controlled content while their CMS session cookie is valid in the same browser. Exploitation is limited by: required admin-level victim session, prior knowledge or guessing of an installed package handle, the admin's browser sending cookies cross-site (defeated by SameSite=Strict session cookies), and the upgrade producing a visible state change that an alert admin may notice. The endpoint itself requires no attacker authentication, but successful impact is entirely dependent on the victim's privilege level at the time of click.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:A) reflects meaningful real-world friction: network reachable and unauthenticated from the attacker's standpoint, but high attack complexity, a present attack requirement (the targeted package must already be installed), and required user interaction (the admin must click or visit attacker-controlled content while logged in). Confidentiality, integrity, and availability impacts are all High because re-triggering a package upgrade can clobber state, alter site code paths, or be chained with a known-vulnerable package version to gain code execution. There is no EPSS data provided, no CISA KEV listing, and no public exploit identified - so this is primarily a targeted-attack risk against organizations whose admins browse externally during privileged sessions, not a mass-exploitation candidate. The PR:N rating in the vector describes the attacker, not the victim - the description makes clear the victim must be an authenticated administrator passing canInstallPackages(), so defenders should treat this as an admin-session-hijack-style risk, not an unauthenticated bug.

An attacker identifies a Concrete CMS site (e.g., via fingerprinting) and a package handle that is installed on it, then hosts a page with an <img>, <iframe>, or auto-navigated link to https://victim-site/dashboard/extend/update/do_update/<pkgHandle>. The attacker lures an administrator - via phishing email, a malicious comment, or watering-hole - into visiting that page while logged into the CMS, and the browser silently issues the GET, causing the server to run upgradeCoreData() and the package's upgrade() routine under the admin's session. No public PoC is currently identified, but the attack requires only standard HTML and no exploit code.