Executive brief
Concrete CMS is a popular open-source content management system used for building and managing websites. A security flaw in the file management component allows an attacker to trick a logged-in user into performing unintended actions, specifically adding folders to their 'favorites' list. While this particular issue has low direct impact on data security, it represents a failure in the system's request validation that could be used in more complex social engineering attacks.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Concrete CMS versions 9.0.0RC1 through 9.5.0 within the 'addFavoriteFolder' method of the backend file controller. The application fails to validate CSRF tokens or implement sufficient SameSite cookie attributes when processing requests to 'concrete/controllers/backend/file'. An attacker can exploit this by inducing an authenticated user to visit a malicious webpage, which then triggers a background request to add a specific folder ID to the user's favorites. This vulnerability is addressed in version 9.5.1 by implementing proper request validation.
Affected products
- Concrete CMS Concrete CMS 9.0.0RC1 through 9.5.0
Timeline
- 2026-05-21: disclosed: NVD publication date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-06-24: patched: Advisory updated with patch information