Concrete CMS versions 9.5.0 and earlier contain a cross‑site request forgery flaw in the install_package() method of the dashboard extend component. When an attacker can make an authenticated administrator visit a crafted page while a malicious package exists under DIR_PACKAGES/<handle>/, the action bypasses the CSRF check and forces the package to install. The package’s install() routine executes under the web server user, giving the attacker remote code execution capabilities. This is a CWE‑352 weakness that can compromise confidentiality, integrity, and availability of the web application and underlying server.

The vulnerability affects all Concrete CMS installations of version 9.5.0 and below, regardless of configuration, as the flaw exists in the core install handling code.

The CVSS v4.0 score of 7.5 indicates high severity. The exploit requires network access (remote), the presence of a privileged administrator, and the deployment of a malicious package, which limits the potential attack surface but still poses a significant risk. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalogue, but the identified impact and severity suggest that handling this flaw promptly is essential.