Which versions of Concrete CMS are affected by CVE-2026-8426?

Concrete CMS 9.5.0 and earlier contains a cross-site request forgery (CSRF) vulnerability in the package upgrade functionality (CVE-2026-8426) that enables remote code execution with administrative…. A patch is available.

How to fix or mitigate CVE-2026-8426?

Within 24 hours: Inventory all Concrete CMS instances running version 9.5.0 or earlier; document which are internet-facing and assess administrative interface exposure. Within 7 days: Enforce multi-factor authentication (MFA) for all CMS administrator accounts; restrict administrative dashboard access by IP address if operationally feasible; implement Web Application Firewall (WAF) rules to block requests to /dashboard/extend/update/prepare_remote_upgrade/* endpoints. Within 30 days: Monitor Concrete CMS security advisories for patch availability; develop upgrade plan to patched version when released; evaluate alternative CMS platforms if patch timeline extends beyond organizational risk tolerance.

Concrete CMS CVE-2026-8426

Q: What is the CVSS score of CVE-2026-8426?

CVE-2026-8426 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31337 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ff5b8ace-8b95-4078-9743-eac1ca5451de

GHSA-5rj5-gfmr-hrc3

PHP CSRF RCE

7.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 21:33 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>. An attacker who controls the remote package returned for a known marketplace item ID can overwrite the package PHP on disk and force its upgrade() method to execute in a single browser navigation. This results in remote code execution as the web server user. In order to be vulnerable, the victim must be passing canInstallPackages, victim site must be connected to the Concrete marketplace; and the attacker controls the package returned for a marketplace item ID already installed on the victim site. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.

AnalysisAI

Remote code execution in Concrete CMS 9.5.0 and earlier is achievable through a CSRF flaw in the /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID> endpoint, which fails to validate anti-CSRF tokens. An attacker who controls a marketplace package matching an item ID already installed on the victim site can overwrite package PHP files and trigger the upgrade() method via a single navigation by a privileged admin, resulting in code execution as the web server user. No public exploit identified at time of analysis, though the vendor (Concrete CMS security team) has acknowledged and rated the issue at CVSS 4.0 7.5.

Technical ContextAI

Concrete CMS is an open-source PHP content management system that supports an extension marketplace, allowing administrators to install and upgrade packages directly from the Concrete marketplace. The vulnerable endpoint sits in the dashboard's package management workflow and accepts a remote marketplace package ID, fetching the corresponding package and writing PHP files to disk before invoking the package's upgrade() lifecycle method. The root cause is CWE-352 (Cross-Site Request Forgery): the endpoint does not enforce a CSRF token, so any authenticated administrator browsing an attacker-controlled page can be coerced into initiating a remote upgrade. Because the upgrade flow trusts the remote package's contents, control over the package payload (achievable if the attacker can publish or substitute the marketplace artifact for a known installed item ID) yields arbitrary PHP execution under the web server account.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later, where the vendor has addressed the missing CSRF validation on the prepare_remote_upgrade endpoint (see https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes). If immediate upgrade is not feasible, compensating controls include revoking the canInstallPackages permission from non-essential administrators (trade-off: blocks legitimate package management from the dashboard), disconnecting the site from the Concrete marketplace until patched (trade-off: prevents marketplace updates and new installs), and restricting dashboard access to a trusted IP range or VPN to reduce CSRF exposure (trade-off: complicates remote administration). Administrators should also avoid browsing untrusted sites in the same session as the CMS dashboard until the patch is applied.