CVE-2026-8434

Vulnerability

Overview

Concrete CMS versions 9 prior to 9.5.0 are vulnerable to a Cross-Site Request Forgery (CSRF) in the concrete/controllers/backend/file controller's rescanMultiple() method. The vulnerability allows an attacker to trick an authenticated admin user into unknowingly triggering a file rescan action, as the endpoint lacks proper CSRF token validation or origin checks [1].

Exploitation

Prerequisites

Exploitation requires an authenticated administrator to visit a malicious page or click a crafted link while logged into Concrete CMS. The attack is network-based, requires no special privileges beyond the victim's session, and has a low attack complexity though limited by the need for user interaction. The CVSS v4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) confirms that authentication is not required for the attacker, but the target must have active admin credentials [1].

Impact

Successful exploitation results in low integrity impact on the application, with no confidentiality or availability effects. The attacker can force the system to rescan files, potentially causing minor operational disruptions or unintended changes to file metadata but cannot modify or exfiltrate data [1].

Mitigation

The fix is included in Concrete CMS version 9.5.0 and later, as documented in the 9.5.1 Release Notes [1]. Users should upgrade to the latest version to remediate this vulnerability. No workarounds are provided.