Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.5.1 | 9.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability described in CVE-2026-8428 is a Cross-Site Request Forgery (CSRF) in the core update functionality of Concrete CMS. The analysis of the patch that fixes this vulnerability confirms that the do_update method in concrete/controllers/single_page/dashboard/system/update/update.php was indeed missing a CSRF token validation. An attacker could exploit this by tricking a logged-in administrator into submitting a crafted form, causing the CMS to update to a version specified by the attacker.
The security patch for version 9.5.1 is comprehensive and addresses multiple vulnerabilities beyond the one described in the CVE. The same commit includes fixes for numerous other CSRF vulnerabilities in functionalities like add-on installation and updates, file management, and page management. Additionally, the patch resolves other security issues such as Server-Side Request Forgery (SSRF) in the file import functionality and several authorization bypasses that could lead to information disclosure. The identified vulnerable functions are the entry points for these actions which were missing the necessary security checks.
