Executive brief
Concrete CMS, a popular content management system, is vulnerable to a security flaw that could allow an attacker to take full control of a website. By tricking an administrator into visiting a malicious link, an attacker can force the site to download and execute malicious code from a compromised marketplace account. This could lead to a total system takeover, data theft, or service disruption.
Technical details
Concrete CMS 9.5.0 and below fails to validate a CSRF token on the `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>` endpoint. An attacker can exploit this by inducing an administrator to visit a malicious URL. If the victim's site is connected to the Concrete marketplace and the attacker has compromised or controls a package already installed on the victim's site, they can overwrite PHP files on the disk. This allows the attacker to trigger the package's upgrade() method, resulting in remote code execution (RCE) as the web server user. The vulnerability is patched in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed
- 2026-05-21: advisory
- 2026-05-21: patched: Version 9.5.1 released