CVE-2026-8426

🗓️ 21 May 2026 20:22:09Reported by ConcreteCMSType

cve🔗 web.nvd.nist.gov👁 23 Views🌐 WEB

Concrete content management CSRF allows remote code execution via package overwrite during prepare_remote_upgrade.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-8426	21 May 202620:22	–	attackerkb
CNNVD	Concrete CMS 跨站请求伪造漏洞	21 May 202600:00	–	cnnvd
Cvelist	CVE-2026-8426 Concrete CMS 9.5.0 and below is vulnerable to CSRF on prepare_remote_upgrade() leading to one-request RCE via package overwrite	21 May 202620:22	–	cvelist
EUVD	EUVD-2026-31337	21 May 202620:22	–	euvd
Github Security Blog	Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>`	21 May 202621:30	–	github
NVD	CVE-2026-8426	21 May 202621:16	–	nvd
OSV	CVE-2026-8426 Concrete CMS 9.5.0 and below is vulnerable to CSRF on prepare_remote_upgrade() leading to one-request RCE via package overwrite	21 May 202620:22	–	osv
OSV	GHSA-5RJ5-GFMR-HRC3 Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>`	21 May 202621:30	–	osv
Positive Technologies	PT-2026-42548	21 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-8426	5 Jun 202619:10	–	redhatcve

NVD

Node

concretecms concrete_cmsRange<9.5.1

[
  {
    "vendor": "Concrete CMS",
    "product": "Concrete CMS",
    "collectionURL": "https://github.com/concretecms/concretecms",
    "repo": "https://github.com/concretecms/concretecms",
    "versions": [
      {
        "status": "affected",
        "version": "5.0",
        "lessThanOrEqual": "9.5.0",
        "versionType": "git"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
documentation	www.documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

Parameter	Position	Path	Description	CWE
canInstallPackages	path	/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>	CSRF allows remote upgrade preparation to be triggered without a valid CSRF token, enabling attacker-controlled remote package replacement and potential RCE on the server.	CWE-829, CWE-352

17 Jun 2026 11:03Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.8

CVSS 47.5

EPSS0.00171

SSVC