VYPR
← All advisories
High severityNVD Advisory· Published May 21, 2026

CVE-2026-8421

CVE-2026-8421

Description

Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.  An attacker who can cause an authenticated administrator to visit a crafted page,  and who has placed or caused a package to be present under DIR_PACKAGES//, can force the installation of that package without any CSRF protection. Package installation executes the package controller's install() method as the web server user, enabling remote code execution.  In order to be vulnerable, the victim must be passing canInstallPackages. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks  https://github.com/maru1009  for reporting.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Concrete CMS before 9.5.1 has a CSRF vulnerability in package installation that allows authenticated admins to be tricked into installing a malicious package, leading to remote code execution.

The vulnerability lies in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php. The method lacks CSRF protection, meaning an attacker can force an authenticated administrator to install a package without their consent.

To exploit this, an attacker must first place a crafted package under the DIR_PACKAGES// directory (e.g., via a separate file upload flaw or by compromising a user with file write permissions). Then, the attacker tricks a victim—who must have the canInstallPackages permission—into visiting a malicious page. The victim's browser then makes a forged request to install the package.

Upon installation, the package controller's install() method executes as the web server user. This can be leveraged for remote code execution, giving the attacker full control over the affected site [1]. The full impact includes compromise of confidentiality, integrity, and availability.

The Concrete CMS security team addressed this in version 9.5.1, which includes a fix for the CSRF vulnerability. The advisory also credits the reporter (maru1009) for discovering the issue. Users are urged to upgrade to 9.5.1 or later as soon as possible [1].

References
  1. 9.5.1 Release Notes

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

36