Executive brief
Concrete CMS is a content management system used to create and manage website content. A flaw in the block-creation API endpoint allowed authenticated editors to bypass file authorization checks, enabling them to embed references to files they shouldn't have access to. This could expose sensitive file URLs and previews to unauthorized users viewing the affected pages.
Technical details
The Area API's block-create endpoint in Concrete CMS versions 9.2.0 through 9.5.2 failed to invoke the block type controller's validate() method on submitted data. For file-referencing blocks (hero_image, gallery), this validation step is responsible for checking whether the user has authorization to access the referenced file via the file-manager policy. An authenticated user with the block-add scope could bypass this check by directly posting a file reference to the endpoint, allowing unauthorized file references to be stored and rendered on pages. The vulnerability discloses file URLs and previews to both page editors and site visitors. The flaw requires authentication with block-add permissions to exploit; no public file storage affects URL disclosure directly, while private storage limits exposure to permission-checked download URLs.
Affected products
- Concrete CMS Concrete CMS 9.2.0 to 9.5.2
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Fix available in versions after 9.5.2