Unauthorized File Access in Concrete CMS by Concrete Five

CVE-2026-7879

What is CVE-2026-7879?

In versions of Concrete CMS up to 9.5.0, a flaw in the submit_password() method located in concrete/controllers/single_page/download_file.php allows unauthorized access to files. This vulnerability circumvents the view_file permission check, enabling any user to download files even if access is restricted by permissions. Furthermore, files that require a password can be downloaded by any user who knows the password, irrespective of their permission status, presenting significant security risks.

References