Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Cross-Site Request Forgery (CSRF) in Concrete CMS. The provided information points to the path concrete/controllers/dialog/page/bulk/cache. The patch for this vulnerability was included in version 9.5.1. By comparing the git tags for versions 9.5.0 and 9.5.1, I identified the security patch commit f22b9dff59454391a50a255a39995bf635deea9e.
Analyzing this commit, I found the relevant change in the file concrete/controllers/dialog/page/bulk/cache.php. The submit() method in the Concrete\Controller\Dialog\Page\Bulk\Cache class was modified. The original code used $this->canAccess() for authorization, which did not perform a CSRF check. The patch replaced this with $this->validateAction(), which is expected to perform the necessary CSRF token validation. The lack of a CSRF token check in a state-changing method is the root cause of the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | >= 9.0.0RC1, < 9.5.1 | 9.5.1 |
