Unauthorized File Deletion in Concrete CMS by Concrete

CVE-2026-7882

What is CVE-2026-7882?

Concrete CMS versions 9.5.0 and earlier are susceptible to unauthorized file deletion due to a flaw in the CSRF token check mechanism within the DeleteFile controller. When a valid token is presented, an error is returned, while an invalid or absent token allows deletion to proceed. This weakness effectively nullifies CSRF safeguards against users who can edit conversation messages, potentially exposing them to malicious cross-site request forgery attacks.

References