CSRF Vulnerability in Concrete CMS 9.5.0 and Below

CVE-2026-8426

What is CVE-2026-8426?

Concrete CMS versions 9.5.0 and earlier are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability that fails to validate CSRF tokens when processing requests to the update endpoint. An attacker controlling the returned remote package can exploit this weakness by injecting malicious code that gets executed during an automatic upgrade process. This can lead to remote code execution under the privileges of the web server user if the victim site is connected to the Concrete marketplace and the victim's configuration allows package installations. This vulnerability emphasizes the critical need for improved security measures against unauthorized requests and malicious package manipulation.

References