Concrete CMS vulnerabilities
139 CVEs and advisories name Concrete CMS as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-8337Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys
- CVE-2026-8240Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure in Backend\SummaryTemplate
- CVE-2026-7881Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block
- CVE-2026-7879Concrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password()
- CVE-2026-8238Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message_page' allowing unauthenticated read of any conversation message
- CVE-2026-8237Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpoint
- CVE-2026-8239Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'
- CVE-2026-8236Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID}
- CVE-2026-8205Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar
- CVE-2026-8204Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog
- CVE-2026-6826Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller
- CVE-2026-8203Concrete CMS 9.5.0 and below has Stored XSS on the height parameter
- CVE-2026-8197Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name
- CVE-2026-8350Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group
- CVE-2026-8421Concrete CMS 9.5.0 and below is vulnerable to CSRF on install_package() with conditional token bypass leading to RCE
- CVE-2026-8428CSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and below
- CVE-2026-8426Concrete CMS 9.5.0 and below is vulnerable to CSRF on prepare_remote_upgrade() leading to one-request RCE via package overwrite
- CVE-2026-8140Concrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controller
- CVE-2026-8417Concrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controller
- CVE-2026-8135Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller.
- CVE-2026-8134Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion
- CVE-2026-2994Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group
- CVE-2026-3240Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form
- CVE-2026-3241Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block.
- CVE-2026-3242Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block
- CVE-2026-3244Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page Names
- CVE-2026-3452Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.
- CVE-2025-8571Concrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page
- CVE-2025-8573Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard page
- CVE-2025-3153Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attribute