CVE-2026-8435 Details
Description
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Concrete CMS versions 9 prior to 9.5.0. The issue resides in the file approval controller, specifically within the 'approveVersion()' method. This vulnerability allows an attacker to trick a user with the 'edit_file_contents' permission into publishing a selected version of a file, potentially leading to unauthorized changes in file management.
Users can upgrade to Concrete CMS version 9.5.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes | ConcreteCMS | Release NotesVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1275 | Sensitive Cookie with Improper SameSite Attribute | ConcreteCMS |
| CWE-352 | Cross-Site Request Forgery (CSRF) | ConcreteCMS |
Affected Products
| Product | Versions |
|---|---|
| concretecms concrete cms | >= 9.0, < 9.5.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | ConcreteCMS |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | Initial Analysis | [email protected] |
| May 21, 2026 | New CVE Received | ConcreteCMS |