Executive brief
Concrete CMS, a popular open-source website content management system, contains a cross-site request forgery (CSRF) vulnerability in its theme configuration interface. An attacker could trick a signed-in administrator into visiting a malicious webpage that automatically submits a forged request to modify the site's theme page-template settings without the administrator's knowledge or consent, allowing unauthorized changes to site configuration.
Technical details
The vulnerability exists in the Dashboard theme Inspect controller's activate_files() action, which processes theme page-template activation requests. The action creates PageTemplate records from attacker-supplied pageTemplates[] parameter values without validating an anti-CSRF token, violating CSRF protection best practices. An attacker can exploit this by hosting a page with JavaScript that auto-submits a POST request to the vulnerable endpoint; when a signed-in administrator visits the attacker's page, the browser automatically includes the administrator's valid session cookies, causing the forged request to execute with administrative privileges. The vulnerability requires the victim to be an authenticated administrator and involves some user interaction (visiting a malicious page), but no patch information is provided in the advisory text.
Affected products
- Concrete CMS Concrete CMS before 9.5.3
Timeline
- 2026-09-15: disclosed