Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | >= 9.0.0RC1, < 9.5.1 | 9.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Cross-Site Request Forgery (CSRF) affecting multiple actions within the file manager. The advisory specifically calls out removeFavoriteFolder, but the security patch f22b9dff59454391a50a255a39995bf635deea9e reveals that a number of other methods in concrete/controllers/backend/file.php were also missing CSRF token validation. These methods (star, rescan, rescanMultiple, approveVersion, addFavoriteFolder, and removeFavoriteFolder) could be triggered by a malicious website visited by a logged-in administrator, causing unintended actions to be performed on their behalf. The patch remediates these issues by adding a CSRF token check to the beginning of each of these functions, ensuring that the request originates from a legitimate user action within the application.
