Executive brief
Concrete CMS, a popular content management system, contains a security flaw that allows unauthorized file deletion. Due to a logic error in how the system verifies security tokens, an attacker can trick a legitimate user into unknowingly deleting files they have permission to manage. This could lead to data loss or disruption of website content if a privileged user visits a malicious link.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Concrete CMS versions 9.5.0 and earlier within the DeleteFile controller. The root cause is an inverted logic check where the application throws an error if a valid CSRF token is provided but proceeds with the deletion if the token is invalid or missing. An attacker can exploit this by inducing a user with file management permissions (specifically those who can edit conversation messages) to submit a crafted request. Successful exploitation allows for unauthorized file deletion. The issue is resolved in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed
- 2026-05-22: advisory
- 2026-05-21: patched: Release of version 9.5.1