CVE-2026-8140

Vulnerability

The download() method in concrete/controllers/single_page/dashboard/extend/install.php does not validate a CSRF token before processing GET requests to /dashboard/extend/install/download/. It only checks the canInstallPackages() permission, leaving the endpoint vulnerable to cross-site request forgery. An attacker can craft a malicious page that, when visited by an authenticated administrator with the necessary permission, triggers an unauthorized download of a marketplace package.

Exploitation

The attack requires the victim to be an authenticated administrator who has the canInstallPackages() permission and the site must be connected to the Concrete marketplace. The attacker can use social engineering or other means to get the admin to visit a crafted URL or page that makes a GET request to the vulnerable endpoint. Since it is a GET request, it can be embedded in an image tag or link, making it easy to execute without the victim's knowledge.

Impact

An attacker can force the download of any marketplace package, potentially including malicious ones, to the server's DIR_PACKAGES directory. This could lead to arbitrary code execution if the package contains malicious code, as it would be installed on the server. The CVSS v4.0 score of 7.5 (High) reflects the potential for high confidentiality, integrity, and availability impact.

Mitigation

Concrete CMS version 9.5.1, released on the same day as this CVE, includes a fix. Users should upgrade to 9.5.1 or later to protect against this vulnerability [1].