Concrete CMS CVE-2026-8427

Exploitation requires that the victim holds an active, authenticated session on a Concrete CMS 9.x instance running a version prior to 9.5.0 at the exact time of the attack. The victim must perform a passive interaction - visiting an attacker-controlled page or loading attacker-controlled content (UI:P per CVSS 4.0). The CVSS AT:P (Attack Requirements: Present) formalizes the dependency on this pre-existing authenticated session as a special precondition. The targeted endpoint is specifically concrete/controllers/backend/file removeFavoriteFolder($id), limiting the impact to the removal of a favorite folder shortcut. Exploitation is bounded by the need for victim interaction combined with an active session; unauthenticated users and users without access to file management are not exploitable targets. The absence of confidentiality or availability impact further constrains operational consequences.

The CVSS 4.0 score of 2.3 is consistent with the limited blast radius of this vulnerability. The vector AV:N/AC:L/AT:P/PR:N/UI:P reflects a network-reachable attack requiring no attacker privileges but dependent on both a special attack condition (AT:P - an authenticated session) and passive user interaction (UI:P). The integrity impact is low (VI:L) on the vulnerable system only; confidentiality and availability are entirely unaffected. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. This vulnerability is not listed in CISA KEV and no public exploit code has been identified, placing it firmly in the lowest operational priority tier. Despite the low complexity (AC:L), the compound prerequisites - active authenticated session plus user interaction - meaningfully reduce real-world exploitability. This is a routine low-severity patch, not an emergency remediation item.

An attacker crafts a malicious web page containing a hidden form or zero-pixel image tag with a src pointing to the removeFavoriteFolder endpoint of a target Concrete CMS instance. When an authenticated CMS editor or administrator visits this page - for example, via a phishing link - the victim's browser automatically submits the forged request using their active session cookie, silently removing the targeted favorite folder without any visible indication to the victim. No public exploit code exists at time of analysis, but the attack is trivially constructible from the CVE description alone.