Concrete CMS versions 9.5.0 and earlier contain a CSRF flaw in the package download endpoint. The download() method forces an authenticated administrator with canInstallPackages permission to retrieve any remote marketplace package without checking a CSRF token. If an attacker can lure an admin to open a crafted link, the server will download and store a malicious package, potentially leading to remote code execution or higher privilege on the site.

Concrete CMS 9.5.0 and all prior releases are affected. The issue is exploitable only on sites that are connected to the Concrete marketplace and where the user holds the canInstallPackages permission. Administrators of these versions must verify whether their installation is up to date and promptly apply any updates that remove the vulnerable endpoint.

The CVSS score of 7.5 indicates high severity, but no EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. The flaw is a state‑changing GET request that relies on CSRF, so a phishing or drive‑by technique is the likely attack vector. Since exploitation requires an authenticated admin and marketplace connectivity, the risk is confined to sites with active admin accounts that use the marketplace. Nevertheless, an attacker can trigger arbitrary package downloads, which can compromise the entire application if the downloaded package contains malicious code.