CVE-2026-8426

Root

Cause

The vulnerability resides in the /dashboard/extend/update/prepare_remote_upgrade/ endpoint of Concrete CMS. Concrete CMS 9.5.0 and below fails to validate a Cross-Site Request Forgery (CSRF) token before processing requests to this endpoint [CVE-2026-8426 description]. This means an attacker can forge a request on behalf of an authenticated administrator without their consent.

Attack

Prerequisites and Vector

To exploit this, three conditions must be met: the victim administrator must be logged in and have the canInstallPackages permission; the victim site must be connected to the Concrete CMS marketplace; and the attacker must control the package that is returned when the marketplace item ID (already installed on the victim site) is requested. If an attacker satisfies these prerequisites, they can craft a malicious link that, when clicked by the victim, triggers the upgrade process with a tampered package. The attack requires user interaction (the victim clicks the link) and high attacker preparation, reflected in the CVSS v4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:A) [CVE-2026-8426 description].

Impact

By controlling the returned package, the attacker can overwrite PHP files on the server disk. When the package's upgrade() method is executed during the subsequent navigation, arbitrary PHP code runs as the web server user, leading to remote code execution (RCE) [CVE-2026-8426 description]. The CVSS v4.0 score of 7.5 (High) reflects the potential for complete compromise of confidentiality, integrity, and availability.

Mitigation

The vulnerability is fixed in Concrete CMS version 9.5.1 [1]. Users should update immediately. The 9.5.1 release notes also mention detecting Composer-installed sites to disallow direct in-app updates, which mitigates the attack surface for those deployments [1]. No workarounds are documented; users on versions prior to 9.5.0 should upgrade as these are also affected.