Concrete CMS CVE-2026-8435

Successful exploitation requires that the target is running Concrete CMS version 9.0 through 9.5.0, that the victim holds an active authenticated session in their browser with permissions to approve file versions via the backend file management interface (concrete/controllers/backend/file approveVersion()), and that the victim can be induced - via phishing, malicious advertisement, or compromised third-party site - to load an attacker-controlled URL or page while that session is active. The CVSS v4.0 AT:P component confirms an attack prerequisite beyond mere network connectivity exists. Exploitation is limited by: (1) mandatory authenticated victim session in the browser at time of attack, (2) passive victim interaction required (visiting attacker-controlled content), (3) impact ceiling is unauthorized file version approval only - no remote code execution, credential theft, or service disruption is achievable through this vector alone, and (4) the attacker must know or guess a valid file version identifier to target a meaningful action.

The CVSS v4.0 score of 2.3 (Very Low) is internally consistent with the attack profile: AV:N (network-reachable) and AC:L (no special complexity) indicate broad reach, but AT:P (prerequisite condition present) and UI:P (user interaction required) impose meaningful real-world friction. The impact is strictly scoped to low integrity within the vulnerable component (VI:L), with no confidentiality impact (VC:N), no availability impact (VA:N), and no scope change affecting subsequent components (SC:N/SI:N/SA:N). No EPSS data was provided in the source intelligence; however, given the Very Low CVSS severity, the CSRF class, the social engineering prerequisite, and the absence of KEV listing and public exploit code, empirical exploitation probability is expected to be minimal. This is not a high-priority remediation target for most organizations. The primary risk scenario is a targeted internal attack - e.g., a disgruntled party or phishing campaign aimed at a CMS editor - rather than opportunistic mass exploitation. No conflicting signals exist between data sources, though a version discrepancy is noted separately.

An attacker identifies a Concrete CMS 9.x deployment and crafts a malicious HTML page containing a hidden auto-submitting form that issues a POST request to the target site's approveVersion() endpoint with a chosen file version identifier. The attacker delivers a link to this page via phishing email to a CMS editor or administrator; when the authenticated victim's browser loads the page, it transparently submits the forged request under the victim's active session cookie, causing the targeted file version to be approved in the CMS without the victim's knowledge or consent. No public exploit code exists at time of analysis, so the attacker must manually construct the CSRF payload.