Is there a patch available for CVE-2026-8434?

Yes, a patch is available for CVE-2026-8434. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8434

Q: What is the CVSS score of CVE-2026-8434?

CVE-2026-8434 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31366 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ConcreteCMS

GHSA-6qjh-p324-694f

CSRF Concrete Cms

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:39 vuln.today

DescriptionCVE.org

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

Cross-Site Request Forgery (CSRF) in Concrete CMS 9.x through 9.5.0 allows a remote unauthenticated attacker to trigger unauthorized file rescanning via the rescanMultiple() function in the backend file controller, provided a logged-in user can be lured to interact with an attacker-crafted page. The integrity impact is limited to the vulnerable component, with no confidentiality or availability consequence. No public exploit or active exploitation has been identified; the Concrete CMS security team assigned a CVSS v4.0 score of 2.3, reflecting the low real-world impact and the prerequisite of user interaction and specific attack conditions.

Technical ContextAI

Concrete CMS is an open-source PHP content management system. The vulnerability resides in the backend file management controller at concrete/controllers/backend/file, specifically the rescanMultiple() method, which rescans one or more uploaded files. This endpoint does not implement adequate CSRF token validation, meaning a forged cross-origin HTTP request can invoke the action on behalf of a legitimately authenticated user. CWE-352 (Cross-Site Request Forgery) describes the root cause: the server accepts state-changing requests without verifying that the request originated from the trusted application interface rather than an external, attacker-controlled source. The CPE string cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* applies to the affected version range. The CVSS 4.0 vector's AT:P (Attack Requirements Present) component aligns with the inherent CSRF precondition that the targeted user must already hold an active authenticated session.

RemediationAI

The primary remediation is to upgrade Concrete CMS to version 9.5.1, which is indicated as the fixed release per the vendor's release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. If an immediate upgrade is not feasible, a compensating control is to restrict access to the backend file management interface (concrete/controllers/backend/file) via web server configuration (e.g., IP allowlisting or authentication gateway), which reduces the attack surface by limiting who can be a valid CSRF target. This workaround has the trade-off of potentially restricting legitimate editor workflows. Given the low severity (CVSS 4.0: 2.3), this issue should be addressed as part of a routine patching cycle rather than an emergency response.