Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions that the download() method in concrete/controllers/single_page/dashboard/extend/install.php is vulnerable to CSRF due to a missing token validation. To confirm this and identify the exact patch, I first identified the patched version (9.5.1) and the last vulnerable version (9.5.0) from the provided information. By comparing the commits between these two versions, I located the security patch commit f22b9dff59454391a50a255a39995bf635deea9e. Analyzing the diff of this commit for the specified file, concrete/controllers/single_page/dashboard/extend/install.php, revealed that checks were added to the download() method to enforce the use of the POST method and to validate a CSRF token. This directly corresponds to the vulnerability description, confirming that Install::download is the vulnerable function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.5.1 | 9.5.1 |
