CVE-2026-8417

🗓️ 21 May 2026 20:19:42Reported by ConcreteCMSType

cve🔗 web.nvd.nist.gov👁 12 Views🌐 WEB

Concrete CMS ≤9.5.0 has a cross site forgery in do_update enabling an authenticated admin to trigger a package upgrade via GET without a token.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-8417	21 May 202620:19	–	attackerkb
CNNVD	Concrete CMS 跨站请求伪造漏洞	21 May 202600:00	–	cnnvd
Cvelist	CVE-2026-8417 Concrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controller	21 May 202620:19	–	cvelist
EUVD	EUVD-2026-31334	21 May 202620:19	–	euvd
NVD	CVE-2026-8417	21 May 202621:16	–	nvd
Positive Technologies	PT-2026-42537	21 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-8417	5 Jun 202619:11	–	redhatcve
Vulnrichment	CVE-2026-8417 Concrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controller	21 May 202620:19	–	vulnrichment

NVD

Node

concretecms concrete_cmsRange<9.5.1

[
  {
    "vendor": "Concrete CMS",
    "product": "Concrete CMS",
    "collectionURL": "https://github.com/concretecms/concretecms",
    "repo": "https://github.com/concretecms/concretecms",
    "versions": [
      {
        "status": "affected",
        "version": "5.0",
        "lessThanOrEqual": "9.5.0",
        "versionType": "git"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
documentation	www.documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

Parameter	Position	Path	Description	CWE
pkgHandle	path	/dashboard/extend/update/do_update/<pkgHandle>	CSRF-vulnerable GET endpoint that triggers a package upgrade without CSRF token validation	CWE-352

17 Jun 2026 11:03Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.18.8

CVSS 47.5

EPSS0.00122

SSVC

CWE-352