CVE-2026-7890: Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block
In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirect-to-internal bypasses. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7890?
The severity of CVE-2026-7890 is rated as low with a CVSS score of 2.1.
What type of vulnerability is CVE-2026-7890?
CVE-2026-7890 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
How do I fix CVE-2026-7890?
To fix CVE-2026-7890, ensure you validate all feed URLs provided in the RSS Displayer block before server-side fetching.
Which versions of Concrete CMS are affected by CVE-2026-7890?
CVE-2026-7890 affects Concrete CMS version 9.5.0 and below.
What potential impact does CVE-2026-7890 have?
CVE-2026-7890 can lead to redirect-to-internal bypasses, compromising internal resources.