CSRF Vulnerability in Concrete CMS Affecting Administrators
CVE-2026-8421

7.5HIGH

Key Information:

Vendor

Concrete Cms

Status
Concrete Cms
Vendor
CVE Published:
21 May 2026

What is CVE-2026-8421?

Concrete CMS versions 9.5.0 and earlier are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability in the package installation process. This flaw allows an attacker to trick an authenticated administrator into visiting a malicious page, facilitating unauthorized package installations through the install_package() method. If exploited, this could lead to remote code execution as the web server user. To prevent this vulnerability, administrators must ensure the 'canInstallPackages' condition is rigorously validated and that all packages are handled securely.

Affected Version(s)

Concrete CMS 5.0 <= 9.5.0

References

https://documentation.concretecms.org/9-x/developers/intr...
release-notes

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.