CVE-2026-81924: Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect controller's activatefiles() action created PageTemplate records from attacker-supplied pageTemplates[] values without validating an anti-CSRF token.A remote attacker could host a page that auto-submitted a forged POST request; when a signed-in administrator visited it, the request executed under the administrator's session and created theme page-template records, changing site configuration without the administrator's consent. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3 - Compensating control
Mitigate CSRF impact by ensuring untrusted sites cannot induce administrator browser sessions to submit forged POST requests (e.g., restrict access to the theme page-template activation functionality and apply CSRF protections at the web tier).
Event History
Frequently Asked Questions
Who is exposed to this CSRF issue?
Concrete CMS installations running versions before 9.5.3 are affected when a signed-in administrator can be induced to interact with attacker-controlled content that submits the forged request.
What does an attacker need to exploit it?
The attacker can remotely host a page that submits a forged POST request containing attacker-controlled pageTemplates[] values. Exploitation relies on the request executing in an authenticated administrator session.
What is the impact of a successful exploit?
The forged request creates theme PageTemplate records through the Dashboard theme Inspect controller's activate_files() action. This changes site configuration without the administrator's consent.
What version resolves the issue?
The issue affects Concrete CMS versions before 9.5.3. Updating to 9.5.3 or later addresses the vulnerable behavior described.