Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as CVE-2026-7879, allows unauthorized file access in Concrete CMS versions 9.5.0 and below. The root cause is a missing permission check in the file download functionality. The analysis of the vulnerability description and the official 9.5.1 release notes clearly pinpoints the issue to the download_file.php controller.
Two functions are identified as vulnerable:
DownloadFile::submit_password: This function handles downloads for password-protected files. The vulnerability existed because the function only verified the provided password and did not check if the user had the necessary view_file permissions. This allowed an attacker who knew a file's password to download it, regardless of access restrictions.DownloadFile::view: This function is the general entry point for file downloads. The vulnerability description mentions that files without passwords could be downloaded freely. This implies that the view function did not perform a permission check for files that were not password-protected, leading to an information disclosure vulnerability.The patch, included in version 9.5.1, addresses these issues by adding the view_file permission check in both functions, ensuring that a user must have the appropriate permissions to download a file, irrespective of whether it is password-protected or not.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.5.1 | 9.5.1 |