The vulnerability arises because the DeleteFile controller incorrectly validates CSRF tokens, deleting files when a token is missing or invalid and proceeding otherwise. This effectively bypasses CSRF protection, allowing an attacker to trick a privileged user into deleting arbitrary files. The weakness is a Cross‑Site Request Forgery flaw (CWE‑352) and results in loss of data integrity for content managed within Concrete CMS.

Concrete CMS version 9.5.0 and below are affected. Any instance of Concrete CMS that has not upgraded past 9.5.0 is vulnerable, and users with permission to edit conversation messages could have files removed by an attacker.

The CVSS v4 score of 2.3 indicates low severity, and no EPSS score is available, suggesting no widespread exploitation. The vulnerability is not listed in CISA KEV. The most likely attack vector is a CSRF request performed by a malicious site or link that exploits an authenticated user’s session. If the user has deletion rights, the attacker could delete any file accessible to that user, potentially impacting critical assets.