Concrete CMS versions 9.5.0 and earlier do not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. The do_update() method checks only that the caller can install packages and then executes upgradeCoreData() and upgrade() on the named package’s controller. Because the endpoint is a state‑changing GET route with no token enforcement, an attacker can force an authenticated administrator to trigger a package upgrade by visiting a crafted URL. This flaw allows the attacker to install or update a package that may contain malicious code in the CMS context, potentially compromising the system’s integrity and confidentiality.

Concrete CMS releases up to and including 9.5.0 are affected. The vulnerable endpoint resides in concrete/controllers/single_page/dashboard/extend/update.php and requires the target package to be already installed and the requesting user to have permission to install packages, typically an administrator.

The CVSS v.4.0 score of 7.5 indicates high severity. The EPSS score is unavailable, so the likelihood of exploitation is currently unknown, but the lack of a CSRF token on a state‑changing GET route yields a clear attack vector. The vulnerability is not listed in the CISA KEV catalog. The attacker requires an authenticated admin session, which is a realistic prerequisite in many environments, making the risk tangible.