Is there a patch available for EUVD-2026-31361?

Yes, a patch is available for EUVD-2026-31361. Update the affected software to the latest version immediately.

Concrete CMS EUVD-2026-31361

Q: What is the CVSS score of EUVD-2026-31361?

EUVD-2026-31361 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7882 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 ConcreteCMS

GHSA-66rg-92q4-6m8q

CSRF Concrete Cms

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:34 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. The code throws an error when the token IS valid and proceeds with file deletion when the token is invalid or missing. This effectively disables CSRF protection for the file deletion endpoint, allowing cross-site request forgery attacks against users who have permission to edit conversation messages. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting.

AnalysisAI

Unauthorized file deletion is possible in Concrete CMS 9.5.0 and below due to an inverted CSRF token validation logic in the DeleteFile controller, where the protection mechanism operates in reverse - rejecting legitimate requests and approving forged ones. A remote unauthenticated attacker (PR:N per CVSS v4.0) can craft a cross-site request forgery attack that deletes files on behalf of any victim authenticated with conversation message editing privileges. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV; the vendor-assigned CVSS v4.0 score of 2.3 reflects the constrained real-world impact given the required victim privilege level and mandatory user interaction.

Technical ContextAI

The root cause is CWE-352 (Cross-Site Request Forgery), but the mechanism is notably unusual: rather than a missing CSRF check, this is an inverted check - the DeleteFile controller logic throws an error when a valid CSRF token is present and proceeds with the destructive file deletion operation when the token is absent or invalid. This effectively transforms the security control into its own bypass. The affected component is tied to Concrete CMS's conversation message editing feature and its associated file management functionality. CPE cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:* covers all Concrete CMS versions through 9.5.0 per EUVD-2026-31361. The CVSS v4.0 vector element AT:P (Attack Requirements: Present) confirms the exploitation depends on specific runtime conditions beyond default network reachability.

RemediationAI

The primary remediation is to upgrade to Concrete CMS 9.5.1, as indicated by the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes, which are expected to correct the inverted CSRF token validation in the DeleteFile controller. The fix version of 9.5.1 is inferred from the release notes URL and has not been independently verified from advisory content. If immediate patching is not feasible, administrators should restrict which user roles hold conversation message editing and file deletion permissions, reducing the pool of potential victims; this has no functional impact for users who do not require this capability. A WAF rule blocking unauthenticated or cross-origin POST requests to the DeleteFile endpoint could reduce exposure but may interfere with legitimate content management workflows. Enforcing strict SameSite=Strict cookie attributes on the session cookie at the web server or reverse proxy level would also mitigate CSRF attacks broadly, though this may break cross-origin integrations if any exist.