Executive brief
Concrete CMS versions below 9.5.3 contain a cross-site request forgery vulnerability in the SEO settings dashboard that allows attackers to reset the administrator-configured list of excluded words. When an authenticated user with SEO access is tricked into visiting a malicious page, an attacker can silently revert the site's SEO slug configuration to defaults, affecting how URLs are generated for pages, files, and other content objects. This undermines the site's carefully configured URL naming policy.
Technical details
The vulnerability is a CSRF flaw in the dashboard's SEO Excluded Words page reset() controller action. The vulnerable code clears the concrete.seo.exclude_words configuration but fails to validate the anti-CSRF token provided by the reset modal and does not enforce the POST HTTP method, allowing GET-based attacks. An unauthenticated attacker can craft a malicious page containing a request that, when visited by an authenticated user with SEO management permissions, triggers an automatic reset of the reserved-word list. This causes the site's Text urlify service to revert to default URL slug generation rules, silently altering SEO behavior for newly created content. The issue was patched in Concrete CMS 9.5.3.
Affected products
- Concrete CMS Concrete CMS below 9.5.3
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in Concrete CMS 9.5.3