CVE-2026-8433

Vulnerability

Description

Concrete CMS versions 9 before 9.5.0 contain a Cross-Site Request Forgery (CSRF) vulnerability in the file rescan controller at /concrete/controllers/backend/file rescan(). This bug allows an attacker to craft a malicious request that, when triggered by an authenticated user, performs unintended operations on the server without the user's consent. The issue stems from insufficient anti-CSRF token validation in the file rescan endpoint [1].

Exploitation and

Attack Surface

Exploitation requires the attacker to trick a logged-in administrative user into unknowingly submitting a forged request, typically via a crafted link or script embedded in a third-party site. The attack vector is network-based and requires user interaction (e.g., clicking a link). No authentication is required by the attacker, but the victim must be authenticated. The attack is low complexity but requires the attacker to reach a specific endpoint [1].

Impact

Successful exploitation results in low integrity impact—the attacker can trigger server-side file rescan operations that may alter file metadata or cause minor data integrity issues, but the vulnerability does not expose confidential data. The CVSS v4.0 score is 2.3, reflecting minimal severity due to the need for user interaction and the limited scope of impact [1].

Mitigation

The vulnerability is fixed in Concrete CMS version 9.5.0, released with the 9.5.1 update. Users are strongly advised to upgrade to version 9.5.1 or later. The vendor also notes behavioral improvements and additional bug fixes in the release notes for this version [1].