Executive brief
Concrete CMS is a popular open-source content management system used for building and managing websites. A security flaw in the file management component allows an attacker to trick a logged-in administrator into performing unintended file rescan operations. While this specific action has limited direct impact, it could be used to disrupt administrative workflows or potentially facilitate more complex attacks.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Concrete CMS versions 9.0.0RC1 through 9.5.0 within the 'concrete/controllers/backend/file rescan()' component. The application fails to properly validate CSRF tokens or implement sufficient SameSite cookie attributes for requests to this endpoint. An attacker can exploit this by inducing an authenticated user to visit a malicious webpage, which then silently triggers a file rescan operation in the background. This vulnerability is addressed in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS 9.0.0RC1 to 9.5.0
Timeline
- 2026-05-21: disclosed: NVD publication date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-06-24: patched: GitHub Advisory updated with patch information