Executive brief
Concrete CMS, a popular content management system, is vulnerable to a security flaw that could allow an attacker to force an administrator to perform unauthorized package updates. By tricking a logged-in administrator into visiting a malicious link, an attacker can trigger system-level changes without the administrator's consent. This could lead to unauthorized modifications of the website's functionality or data integrity issues.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Concrete CMS versions 9.5.0 and below. The `do_update()` method in `concrete/controllers/single_page/dashboard/extend/update.php` fails to validate CSRF tokens before executing `upgradeCoreData()` and `upgrade()` on a package's controller. Because the `/dashboard/extend/update/do_update/<pkgHandle>` endpoint is a state-changing GET route without token enforcement, an attacker can use cross-site navigation to force an authenticated administrator (with `canInstallPackages` permissions) to trigger an upgrade for an already installed package. This issue is resolved in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed
- 2026-05-21: advisory
- 2026-05-21: patched: Fixed in version 9.5.1