Concrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controller

published 2026-05-21 5 mo ago modified 2026-09-10 1 mo ago also GHSA-66rg-92q4-6m8q , EUVD-2026-31361

cvss: 4.3; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits: 0; none known

Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. The code throws an error when the token IS valid and proceeds with file deletion when the token is invalid or missing. This effectively disables CSRF protection for the file deletion endpoint, allowing cross-site request forgery attacks against users who have permission to edit conversation messages. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting.

Patch / fix

fixed in 2

packagist concrete5/concrete5 9.5.1
concretecms concrete_cms 9.5.1

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 5 mo ago (2026-05-22)

Exploit prediction

0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	2.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA	4.0	2.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	concrete5/concrete5	<9.5.1	9.5.1

Affected products

Concrete CMS Concrete CMS

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

documentation.concretecms.org /9-x/developers/introduction/version-history/951-release-notes
release-notes, web
nvd.nist.gov /vuln/detail/CVE-2026-7882
advisory
github.com /concretecms/concretecms
package

Sources

CVE List CVE-2026-7882
GitHub Advisory GHSA-66rg-92q4-6m8q
NVD CVE-2026-7882

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary