Executive brief
Concrete CMS, a popular content management system, is vulnerable to an attack that could allow an unauthorized person to force an administrator's browser to download software packages from the official marketplace. This occurs because the system fails to verify that a download request was intentionally initiated by the administrator. If an attacker successfully tricks a logged-in administrator into visiting a malicious website, they could potentially install arbitrary marketplace packages on the server, leading to unauthorized changes or service disruption.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Concrete CMS versions 9.5.0 and earlier due to a lack of token validation in the `download()` method within `concrete/controllers/single_page/dashboard/extend/install.php`. The affected endpoint, `/dashboard/extend/install/download/<remoteId>`, is a state-changing GET route that only verifies the `canInstallPackages()` permission without enforcing CSRF tokens. An attacker can exploit this by inducing an authenticated administrator with installation privileges to visit a malicious URL. This results in the server fetching a remote marketplace package and writing it to the `DIR_PACKAGES` directory. The vulnerability requires the site to be connected to the Concrete marketplace to be exploitable. This issue is resolved in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: advisory: Initial disclosure and NVD publication
- 2026-05-21: disclosed
- 2026-06-23: other: Advisory updated and reviewed by GitHub