2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8434

CVE-2026-8434: Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8434

CVE-2026-8434:

2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	>= 9.0.0RC1, < 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described in GHSA-6qjh-p324-694f is a Cross-Site Request Forgery (CSRF) in the rescanMultiple() function within concrete/controllers/backend/file.php. Analysis of the security patch commit f22b9dff59454391a50a255a39995bf635deea9e for Concrete CMS version 9.5.1 confirms this. The patch adds CSRF token validation to the rescanMultiple() function, which was previously absent. An attacker could have exploited this by crafting a malicious request and tricking an authenticated user with the necessary permissions into executing it, leading to an unwanted file rescan operation. The same commit also patched several other methods in the same file for similar CSRF vulnerabilities, including star(), rescan(), approveVersion(), addFavoriteFolder(), and removeFavoriteFolder(). All these functions now include a check for a valid CSRF token before executing their respective actions.

Vulnerable functions

Concrete\Controller\Backend\File::rescanMultiple

concrete/controllers/backend/file.php

The `rescanMultiple` function in `concrete/controllers/backend/file.php` was missing a Cross-Site Request Forgery (CSRF) token validation. This allowed an attacker to trick an authenticated user with file editing permissions into triggering a rescan of multiple files by submitting a crafted request. The patch adds a CSRF token check to prevent this.

Concrete\Controller\Backend\File::star

concrete/controllers/backend/file.php

The `star` function in `concrete/controllers/backend/file.php` was missing a Cross-Site Request Forgery (CSRF) token validation. This allowed an attacker to trick an authenticated user into starring files by submitting a crafted request. The patch adds a CSRF token check to prevent this.

Concrete\Controller\Backend\File::rescan

concrete/controllers/backend/file.php

The `rescan` function in `concrete/controllers/backend/file.php` was missing a Cross-Site Request Forgery (CSRF) token validation. This allowed an attacker to trick an authenticated user with file editing permissions into triggering a rescan of a file by submitting a crafted request. The patch adds a CSRF token check to prevent this.

Concrete\Controller\Backend\File::approveVersion

concrete/controllers/backend/file.php

The `approveVersion` function in `concrete/controllers/backend/file.php` was missing a Cross-Site Request Forgery (CSRF) token validation. This allowed an attacker to trick an authenticated user with file editing permissions into approving a file version by submitting a crafted request. The patch adds a CSRF token check to prevent this.

Concrete\Controller\Backend\File::addFavoriteFolder

concrete/controllers/backend/file.php

The `addFavoriteFolder` function in `concrete/controllers/backend/file.php` was missing a Cross-Site Request Forgery (CSRF) token validation. This allowed an attacker to trick an authenticated user into adding a folder to their favorites by submitting a crafted request. The patch adds a CSRF token check to prevent this.

Concrete\Controller\Backend\File::removeFavoriteFolder

concrete/controllers/backend/file.php

The `removeFavoriteFolder` function in `concrete/controllers/backend/file.php` was missing a Cross-Site Request Forgery (CSRF) token validation. This allowed an attacker to trick an authenticated user into removing a folder from their favorites by submitting a crafted request. The patch adds a CSRF token check to prevent this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.