PT-2026-42548 · Unknown · Concrete Cms

Maru1009 · Published 2026-05-21 · Updated 2026-05-21 · CVE-2026-8426

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.1

Description Concrete CMS fails to validate a Cross-Site Request Forgery (CSRF) token—a unique value used to prevent unauthorized commands from being transmitted from a user the web application trusts—before processing requests to the endpoint '/dashboard/extend/update/prepare remote upgrade/'. An attacker who controls the remote package returned for a known marketplace item ID can overwrite the package PHP on disk and force the upgrade() function to execute via a single browser navigation. This leads to remote code execution as the web server user. For this to be possible, the victim must have canInstallPackages permissions, the site must be connected to the Concrete marketplace, and the attacker must control the package returned for a marketplace item ID already installed on the victim site.

Recommendations Update to a version newer than 9.5.0.

Fix

RCE

CSRF

Weakness Enumeration

CWE-829

CWE-352

Related Identifiers

CVE-2026-8426

Affected Products

Concrete Cms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-8426 · Security Note
• https://t.me/CVEtracker/54556 · Telegram Post
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Note