Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.5.1 | 9.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability, identified as CVE-2026-8426, is a Cross-Site Request Forgery (CSRF) in Concrete CMS version 9.5.0 and earlier. The root cause is the lack of CSRF token validation in several methods within the concrete/controllers/single_page/dashboard/extend/update.php controller, which handled package updates.
The primary function associated with CVE-2026-8426 is prepare_remote_upgrade. This function, accessible via a GET request to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>, did not validate a CSRF token. This allowed an attacker to trick an authenticated administrator into visiting a crafted URL, which would cause the CMS to download and overwrite a package from a malicious source.
The exploit chain continues with another CSRF vulnerability (CVE-2026-8417) in the do_update function of the same controller. This function, also accessible via a GET request, was responsible for triggering the package upgrade process. By chaining these two vulnerabilities, an attacker could first inject a malicious package and then execute its upgrade() method, leading to remote code execution on the server.
The patch in version 9.5.1 addresses these issues by enforcing POST requests and adding CSRF token validation ($this->token->validate(...)) to prepare_remote_upgrade, do_update, and other related functions, effectively mitigating the CSRF threat. The analysis of the patch commit f22b9dff59454391a50a255a39995bf635deea9e clearly shows these added security checks. Therefore, any runtime profile during exploitation of this vulnerability would show calls to Concrete\Controller\SinglePage\Dashboard\Extend\Update::prepare_remote_upgrade and Concrete\Controller\SinglePage\Dashboard\Extend\Update::do_update.
