CVE-2026-8417: Concrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controller
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/doupdate/<pkgHandle>. The doupdate() method in concrete/controllers/singlepage/dashboard/extend/update.php checks only canInstallPackages() before executing upgradeCoreData() and upgrade() on the named package's controller. Because the endpoint is a state-changing GET route with no token enforcement, an attacker can force an authenticated administrator to trigger a package upgrade via a single cross-site navigation.In order to be vulnerable, the victim must be passing canInstallPackages() and and a target package must already be already installed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update Concrete CMS so that do_update() validates a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle> (the issue is that Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests).
Concrete CMS package update endpoint (/dashboard/extend/update/do_update/<pkgHandle>) CSRF token validation = enabled - Configuration
Ensure do_update() enforces token enforcement (CSRF validation) in addition to the existing canInstallPackages() check before executing upgradeCoreData() and upgrade() for the named package controller.
Concrete CMS do_update() Access control for triggering upgrades = require CSRF + proper authorization checks
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8417?
CVE-2026-8417 has a severity rating of high, with a CVSS score of 7.5.
What is the risk associated with CVE-2026-8417?
The risk associated with CVE-2026-8417 is rated as 51.
How do I fix CVE-2026-8417?
To fix CVE-2026-8417, you should upgrade Concrete CMS to version 9.5.1 or above, which addresses the CSRF vulnerability.
What does CVE-2026-8417 exploit?
CVE-2026-8417 exploits a CSRF vulnerability in the do_update() method of the Concrete CMS package update controller.
Which versions of Concrete CMS are affected by CVE-2026-8417?
CVE-2026-8417 affects Concrete CMS versions 9.5.0 and below.