Title: Concrete CMS, Description: Concrete CMS 9.5.0 y versiones anteriores no valida un token CSRF antes de procesar solicitudes a /dashboard/extend/install/download/<remoteId>. El método download() en concrete/controllers/single_page/dashboard/extend/install.php verifica solo el permiso canInstallPackages() antes de obtener un paquete remoto del marketplace y escribirlo en el directorio DIR_PACKAGES del servidor. Debido a que el endpoint es una ruta GET que cambia de estado sin aplicación de token, un atacante que puede hacer que un administrador autenticado visite una página manipulada puede forzar la descarga de un paquete arbitrario del marketplace. Para ser vulnerable, la víctima debe tener canInstallPackages() y el sitio debe estar conectado al marketplace de Concrete. El equipo de seguridad de Concrete CMS otorgó a esta vulnerabilidad una puntuación CVSS v.4.0 de 7.5 con el vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Gracias a https://github.com/maru1009 por informar.

{"timestamp":"2026-05-22T12:13:44.798973Z","id":"CVE-2026-8140","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Concrete CMS","product":"Concrete CMS","defaultStatus":"unaffected","collectionURL":"https://github.com/concretecms/concretecms","repo":"https://github.com/concretecms/concretecms","versions":[{"version":"5.0","lessThanOrEqual":"9.5.0","versionType":"git","status":"affected"}]}]

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

OR
          *cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:* versions up to (including) 9.5.0

ConcreteCMS: https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Types: Release Notes

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method in concrete/controllers/single_page/dashboard/extend/install.php checks only the canInstallPackages() permission before fetching a remote marketplace package and writing it to the server's DIR_PACKAGES directory. Because the endpoint is a state-changing GET route with no token enforcement, an attacker who can cause an authenticated administrator to visit a crafted page can force an arbitrary marketplace package to be downloaded. In order to be vulnerable, the victim must be passing canInstallPackages() and the site must be connected to the Concrete marketplace. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks  https://github.com/maru1009  for reporting.

AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE-352

https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes