CVE-2026-7882: Concrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controller
Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. The code throws an error when the token IS valid and proceeds with file deletion when the token is invalid or missing. This effectively disables CSRF protection for the file deletion endpoint, allowing cross-site request forgery attacks against users who have permission to edit conversation messages. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7882?
The severity of CVE-2026-7882 is rated as low, with a CVSS score of 4.0.
What vulnerability is present in CVE-2026-7882?
CVE-2026-7882 presents a vulnerability to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller of Concrete CMS.
How can I fix CVE-2026-7882?
To fix CVE-2026-7882, upgrade to a version of Concrete CMS higher than 9.5.0 where this vulnerability has been addressed.
What is the impact of exploiting CVE-2026-7882?
Exploiting CVE-2026-7882 can allow attackers to delete files without proper authorization, compromising the integrity of the system.
When was CVE-2026-7882 published?
CVE-2026-7882 was published on May 21, 2026.