Which versions of Concrete CMS are affected by CVE-2026-8421?

A cross-site request forgery vulnerability in Concrete CMS 9.5.0 and earlier enables attackers to trick administrators into installing malicious packages, leading to remote code execution on affected…. A patch is available.

How to fix or mitigate CVE-2026-8421?

Within 24 hours: audit and restrict the canInstallPackages permission to essential administrators only; send security awareness alert to all Concrete CMS administrators warning against unsolicited package installation requests. Within 7 days: deploy Web Application Firewall with CSRF detection rules; implement monitoring and alerting for all package installation activities. Within 30 days: contact Concrete5/Concrete CMS vendor for patch timeline and establish upgrade plan; evaluate and plan migration to alternative CMS platforms if patch timeline is unclear.

Concrete CMS CVE-2026-8421

Q: What is the CVSS score of CVE-2026-8421?

CVE-2026-8421 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31339 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ff5b8ace-8b95-4078-9743-eac1ca5451de

GHSA-4c8m-6fwx-m7xq

PHP CSRF RCE

7.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 21:33 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php. An attacker who can cause an authenticated administrator to visit a crafted page, and who has placed or caused a package to be present under DIR_PACKAGES/<handle>/, can force the installation of that package without any CSRF protection. Package installation executes the package controller's install() method as the web server user, enabling remote code execution. In order to be vulnerable, the victim must be passing canInstallPackages. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.

AnalysisAI

Cross-site request forgery in Concrete CMS 9.5.0 and earlier allows remote attackers to coerce an authenticated administrator with canInstallPackages permission into installing an attacker-controlled package, resulting in remote code execution as the web server user. The flaw resides in the install_package() method of the dashboard's extend/install.php controller, which lacks CSRF token validation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Concrete CMS is a PHP-based content management system whose dashboard exposes package management functionality at concrete/controllers/single_page/dashboard/extend/install.php. The install_package() method is intended to invoke a package's install() controller after the administrator authorizes the action, but it omits the framework's anti-CSRF token validation (CWE-352, Cross-Site Request Forgery). Because package install() handlers execute arbitrary PHP under the web server user, any state-changing request that reaches this endpoint with valid session cookies can pivot from CSRF into full code execution. The attack additionally depends on a package directory already existing under DIR_PACKAGES/<handle>/, which on many deployments includes shipped or previously uploaded packages.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later, which per the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes addresses this issue; the exact fix commit is not independently confirmed in the supplied data, so verify the change list before deployment. Until patching is possible, restrict the canInstallPackages permission to the smallest set of trusted administrators, remove unused or untrusted package directories from DIR_PACKAGES so there is nothing for install_package() to instantiate, and require admins to access the dashboard from a separate browser profile or via SSO with short session lifetimes to shrink the CSRF window. A reverse-proxy or WAF rule blocking POSTs to /dashboard/extend/install lacking the framework's CSRF token can also serve as a stopgap, with the trade-off that legitimate package installations from the dashboard will be blocked while the rule is active.