CVE-2026-8421 Concrete CMS CVE debrief

Who should care

Concrete CMS administrators, platform teams, and security responders managing installs that allow package installation. Highest concern is for environments where privileged admins browse untrusted content while logged in and where packages may be staged on disk under DIR_PACKAGES/<handle>/.

Technical summary

The vulnerable endpoint is concrete/controllers/single_page/dashboard/extend/install.php::install_package(). The CVE description says the attack requires an authenticated administrator who passes canInstallPackages, a crafted page to induce the request, and a package already present in DIR_PACKAGES/<handle>/. NVD classifies the issue with CVSS v4.0 vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N and maps it to CWE-352 (CSRF) as a secondary weakness. The practical impact is that a CSRF-driven admin action can invoke package installation logic and execute the package controller's install() method as the web server user.

Defensive priority

High

Recommended defensive actions

• Upgrade Concrete CMS to a version that includes the vendor fix; the supplied official vendor reference is the Concrete CMS 9.5.1 release notes.
• Restrict who can pass canInstallPackages and review which administrators can install packages.
• Audit DIR_PACKAGES/<handle>/ for any unexpected or untrusted packages before and after remediation.
• Reduce exposure to CSRF by keeping administrator sessions short-lived and avoiding admin browsing of untrusted content while logged in.
• Monitor for unexpected package installation events and review web server process activity tied to package install() execution.

Evidence notes

All material facts are taken from the supplied CVE record and NVD metadata. The CVE description provides the vulnerable method, attack preconditions, and impact. NVD supplies the CVSS v4.0 vector and a CWE-352 mapping. The only vendor-facing reference in the corpus is the official Concrete CMS 9.5.1 release notes URL, which supports the product attribution but does not, in this corpus, expose additional fix details. The vendor field in the supplied data is marked low-confidence/needs review, so the product attribution should be treated as supported by the description and reference rather than by a high-confidence vendor mapping.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.