Executive brief
Concrete CMS, a popular content management system, is vulnerable to a security flaw that could allow an attacker to trick an administrator into performing unintended file management actions. By convincing a logged-in user to click a malicious link, an attacker can trigger a 'rescan' of multiple files on the server. While this does not directly expose data, it allows unauthorized modification of system state and could disrupt administrative workflows.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Concrete CMS versions 9.0.0RC1 through 9.5.0 within the 'concrete/controllers/backend/file' component. The 'rescanMultiple()' function fails to validate a security token (CSRF token) before processing requests. An attacker can exploit this by crafting a malicious webpage or link that, when visited by an authenticated administrator, silently submits a request to the vulnerable endpoint. This allows the attacker to force the application to rescan multiple files. The vulnerability is mitigated by the requirement for user interaction and the limited impact of the rescan action. The issue is addressed in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS >= 9.0.0RC1, < 9.5.1
Timeline
- 2026-05-21: disclosed: NVD Published Date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-06-24: patched: GitHub Advisory reviewed and updated with patch info