CVE-2026-8340: Concrete CMS CSRF Vulnerability in File Version Approval
Summary
CVE-2026-8340: Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion. Affects concrete5/concrete5 versions < 9.5.1. Fixed in 9.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system that enables users to build and manage websites easily. It offers a range of features including user permissions, file management, and version control for uploaded content. However, versions 9.5.0 and below are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability that can compromise the integrity of file version management.
Vulnerability Detail
Concrete CMS 9.5.0 and earlier versions are vulnerable to CSRF attacks via the Backend\File::approveVersion function. This vulnerability allows an attacker to trick a user with edit_file_contents permission into approving an attacker-selected version of a file. This could lead to unauthorized downgrades of files or the activation of unpublished versions, potentially compromising the website's content integrity.
How To Fix
Minimum fixed version
9.5.1
This is the first release that contains the fix.
composer require concrete5/concrete5:9.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the file version approval functionality for users who do not need it. This can be done by adjusting user permissions in the Concrete CMS dashboard.
Conclusion
The CSRF vulnerability identified as CVE-2026-8340 in Concrete CMS poses a significant risk to users with file editing permissions. It is crucial to update to version 9.5.1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Cross-Site Request Forgery (CSRF) is a type of attack that tricks a user into executing unwanted actions on a web application in which they are authenticated.
If you are using Concrete CMS version 9.5.0 or below, your installation is vulnerable. You can check your version in the dashboard or by inspecting the composer.lock file.
If left unaddressed, this vulnerability could allow attackers to manipulate file versions, potentially leading to data loss or unauthorized content changes.
Yes, you can use Vulert to monitor your project for open-source vulnerabilities in real-time. It analyzes your composer.lock file without requiring code access.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
