Cross-Site Request Forgery in Concrete CMS via Unvalidated Token in Update Process

CVE-2026-8428

What is CVE-2026-8428?

Concrete CMS versions 9.5.0 and earlier are susceptible to a Cross-Site Request Forgery vulnerability due to the failure to validate CSRF tokens during update processes. The system improperly emits a CSRF token in the local_available_update.php view, yet neglects to invoke the necessary validation method in the update controller. This oversight allows attackers to forge malicious POST requests that can trigger an unauthorized CMS update to a version specified by the attacker. For exploitation, the target must permit upgrades and a valid update version must be available in the core updates directory.

References