Executive brief
Concrete CMS, a popular open-source content management system, contains a vulnerability in its Boards feature that allows attackers to forge requests and inject malicious slot and template data into boards. An attacker can trick a logged-in user with board-editing permissions into visiting a malicious website, which silently modifies the board's contents under that user's authority without their knowledge or consent.
Technical details
The vulnerability is a Cross-Site Request Forgery (CSRF) attack in the custom_slot.php dialog controller's saveTemplate() action, which fails to validate anti-CSRF tokens before processing requests. The action creates a board_slot_proxy Block and dispatches an AddCustomSlotToBoardCommand while only checking per-resource canEditBoardContents() permissions. An unauthenticated attacker can craft a malicious cross-site request that, when visited by a user with active board-edit permissions, will write arbitrary slot and template data to a board. The database write completes before any HTTP response is rendered, ensuring the attack succeeds even if the response returns a non-200 status code. Patches are available in Concrete CMS 9.5.3 and later.
Affected products
- Concrete CMS Concrete CMS 9 through 9.5.2
Timeline
- 2026-09-10: disclosed