PT-2026-42555 · Unknown · Concrete Cms

Tristan Mandani · CVE-2026-7882 · Published 2026-05-21 · Updated 2026-05-22

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.1

Description An inverted CSRF token check in the DeleteFile controller allows unauthorized file deletion. The system incorrectly throws an error when the token is valid and proceeds with the deletion process when the token is invalid or missing. This flaw disables Cross-Site Request Forgery (CSRF) protection—a mechanism used to prevent unauthorized commands from being transmitted from a user the web application trusts—for the file deletion endpoint, enabling attacks against users with permissions to edit conversation messages.

Recommendations Update to a version newer than 9.5.0. As a temporary workaround, restrict access to the DeleteFile controller to minimize the risk of unauthorized file deletion.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-7882

GHSA-66RG-92Q4-6M8Q

Affected Products

Concrete Cms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7882.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-7882 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66rg-92q4-6m8q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7882 · Security Note
• https://github.com/concretecms/concretecms · Note
• https://twitter.com/CVEnew/status/2057783213003596171 · Twitter Post
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Note
• https://twitter.com/infoflowcloud/status/2057785073953325197 · Twitter Post