Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Cross-Site Request Forgery (CSRF) at the specific endpoint concrete/controllers/dialog/express/association/reorder. This directly points to the controller file concrete/controllers/dialog/express/association/reorder.php and the class Concrete\Controller\Dialog\Express\Association\Reorder. CSRF vulnerabilities in form-handling controllers are typically found in the methods that process the submitted data, which in Concrete CMS are conventionally named submit() or are handled within the view() method itself. The vulnerability is caused by the absence of a CSRF token check in these methods, allowing an attacker to perform unauthorized actions on behalf of a logged-in user. The fix, implemented in version 9.5.1, would have been to add this missing validation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | >= 9.0.0RC1, < 9.5.1 | 9.5.1 |
