CVE-2026-8426: Concrete CMS 9.5.0 and below is vulnerable to CSRF on prepare_remote_upgrade() leading to one-request RCE via package overwrite
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepareremoteupgrade/<remoteMPID>. An attacker who controls the remote package returned for a known marketplace item ID can overwrite the package PHP on disk and force its upgrade() method to execute in a single browser navigation. This results in remote code execution as the web server user. In order to be vulnerable, the victim must be passing canInstallPackages, victim site must be connected to the Concrete marketplace; and the attacker controls the package returned for a marketplace item ID already installed on the victim site. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In Concrete CMS, ensure /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID> validates a CSRF token before processing requests (vulnerable in Concrete CMS 9.5.0 and below where it does not validate CSRF).
Concrete CMS (endpoint /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>) CSRF token validation = enabled - Compensating control
If the victim site is not required to connect to the Concrete marketplace or to install marketplace packages, disconnect it from the Concrete marketplace / disable marketplace package installation so that prepare_remote_upgrade() cannot be abused (attack requires canInstallPackages and a marketplace connection).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8426?
The severity of CVE-2026-8426 is rated high with a CVSS score of 7.5.
What does CVE-2026-8426 exploit?
CVE-2026-8426 exploits a Cross-Site Request Forgery (CSRF) vulnerability in Concrete CMS 9.5.0 and below.
What are the potential consequences of CVE-2026-8426?
The potential consequences of CVE-2026-8426 include remote code execution through package overwrites.
How can CVE-2026-8426 be mitigated?
Mitigation for CVE-2026-8426 involves upgrading to Concrete CMS version 9.5.1 or higher, which addresses this vulnerability.
When was CVE-2026-8426 published?
CVE-2026-8426 was published on May 21, 2026.