Concrete CMS versions 9.5.0 and earlier do not validate a CSRF token before processing requests to the prepare_remote_upgrade endpoint. An attacker who can supply a malicious package for a marketplace item ID already installed on a victim site can overwrite that package’s PHP file on disk. The subsequent upgrade() method is executed during a single browser navigation, resulting in remote code execution as the web server user. The flaw combines CWE‑352 Cross‑Site Request Forgery and CWE‑829 Broken Access Control, and it allows an attacker to compromise both confidentiality and integrity of the affected application.

The vulnerability affects Concrete CMS 9.5.0 and all earlier 9.x releases. Anyone running those versions with the canInstallPackages feature enabled and a site connected to the Concrete marketplace is potentially vulnerable. Versions newer than 9.5.0 are not impacted by this flaw.

The CVSS base score of 7.5 reflects high severity; the exploit requires the victim to have an active administrative session and the site to be configured to accept remote marketplace packages, conditions that are common on many installations. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Because the vulnerability can be exercised in a single request, an attacker who can direct a user to a crafted URL may trigger RCE without further interaction. The lack of CSRF protection means the attack can be performed by simply loading a malicious link in the victim’s browser.