Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-7890, is a Server-Side Request Forgery (SSRF) in the RSS Displayer block of Concrete CMS. The root cause is the lack of input validation on the RSS feed URL provided by a page editor. The getFeed method within the RssDisplayer block's controller (concrete/blocks/rss_displayer/controller.php) would directly use the provided URL with Feed::load(), causing the server to make a request to any URL, including internal network addresses. This could be exploited by a malicious user with page editing permissions to scan the internal network or access internal services.
The patch, included in version 9.5.1, addresses this by introducing a new URL validation service (RemoteUrlValidator). The getFeed function was modified to use this validator to ensure that the provided URL is a safe, public remote address before any request is made. The view method of the same controller calls getFeed, making it the initial entry point in the vulnerable execution flow when the RSS block is rendered.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.5.1 | 9.5.1 |
