Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability described is a Cross-Site Request Forgery (CSRF) in the addFavoriteFolder function of Concrete CMS. By analyzing the security patch that fixed this issue, I was able to pinpoint the exact vulnerable function and the nature of the fix. The patch, found in commit f22b9dff59454391a50a255a39995bf635deea9e, clearly shows the addition of CSRF token validation to several functions within the concrete/controllers/backend/file.php file. The primary function mentioned in the vulnerability description, addFavoriteFolder, was indeed missing this validation, as was removeFavoriteFolder. The absence of this check meant that an attacker could craft a malicious request and, if a logged-in user visited a page containing this request, an action (like adding or removing a favorite folder) would be performed on their behalf without their knowledge. The patch rectifies this by ensuring that a valid CSRF token is present for these actions, thus confirming the request's legitimacy.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | >= 9.0.0RC1, < 9.5.1 | 9.5.1 |
