Which versions of Concrete CMS are affected by CVE-2026-8417?

Concrete CMS versions 9.5.0 and earlier contain a cross-site request forgery vulnerability that allows authenticated administrators to be coerced into triggering arbitrary package upgrades when…. A patch is available.

How to fix or mitigate CVE-2026-8417?

Within 24 hours: Identify all Concrete CMS instances running version 9.5.0 or earlier and document them for remediation tracking; disable package auto-update functionality via application configuration. Within 7 days: Restrict administrative dashboard access via IP allowlist or VPN-only requirements, deploy WAF rules blocking POST/GET to /dashboard/extend/update/do_update endpoints, and provide security awareness briefing on CSRF attack mechanics. Within 30 days: Monitor Concrete CMS vendor advisories continuously for patch release; prepare and test upgrade plan to patched version when available.

Concrete CMS CVE-2026-8417

Q: What is the CVSS score of CVE-2026-8417?

CVE-2026-8417 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31334 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ConcreteCMS

GHSA-jr5g-qv3g-rxxx

PHP CSRF

7.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 21:04 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() method in concrete/controllers/single_page/dashboard/extend/update.php checks only canInstallPackages() before executing upgradeCoreData() and upgrade() on the named package's controller. Because the endpoint is a state-changing GET route with no token enforcement, an attacker can force an authenticated administrator to trigger a package upgrade via a single cross-site navigation.In order to be vulnerable, the victim must be passing canInstallPackages() and and a target package must already be already installed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.

AnalysisAI

Cross-site request forgery in Concrete CMS 9.5.0 and earlier allows remote attackers to coerce an authenticated administrator into triggering arbitrary package upgrades by luring them to a malicious page that issues a single GET to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() handler only checks the canInstallPackages() permission and omits CSRF token validation on this state-changing route, so a cross-site navigation is sufficient to invoke upgradeCoreData() and the package controller's upgrade() routine. No public exploit identified at time of analysis and no CISA KEV listing; EPSS not provided.

Technical ContextAI

The flaw lives in concrete/controllers/single_page/dashboard/extend/update.php within Concrete CMS, a PHP-based open-source content management platform. The vulnerable route is exposed as a GET endpoint that performs state-changing operations (package upgrade) without enforcing the framework's CSRF token, classic CWE-352 (Cross-Site Request Forgery). The handler authorizes the action solely via the canInstallPackages() permission check - an authentication/authorization gate - rather than tying execution to a one-time anti-forgery token bound to the admin session, so any authenticated session in the victim's browser is implicitly trusted by the endpoint. CPE coverage is cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:*, indicating the core product across versions up to and including 9.5.0.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later, which the vendor's 9.5.1 release notes (https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes) cover as the patched release; this is the primary fix and adds CSRF token enforcement to the do_update route. Until upgrading, restrict access to /dashboard/extend/update/do_update/* at a reverse proxy or WAF so it is reachable only from trusted internal networks or VPN - note this breaks legitimate package upgrades from outside that perimeter. Administrators should also use a dedicated browser profile (or private session) for CMS administration to prevent cross-site navigation from carrying authenticated cookies, and uninstall any unused packages so the precondition 'target package already installed' is minimized. SameSite=Strict cookies on the session can mitigate cross-site GET-based CSRF but may interfere with single sign-on flows.