The vulnerability is a Cross‑Site Request Forgery flaw in the file star() controller of Concrete CMS. When an unauthenticated CSRF token is missing, the server processes file operations requested by the victim’s browser. The impact is limited to the actions that the authenticated user can perform, such as file deletion or renaming, and the CVE is rated low with a CVSS score of 2.3. The description does not explicitly state authentication requirements, but it is inferred that the attacker must coerce an authenticated user to submit the malicious request.

All installations of Concrete CMS 9 that are running any version earlier than 9.5.0 are affected. No further version granularity is specified, so the entire series of releases before 9.5.0 is considered vulnerable.

Risk is low: CVSS of 2.3, EPSS not available, not listed in CISA KEV. The CSRF weakness (CWE‑352) typically requires the victim to be logged in and the attacker to deliver a forged request, often through social engineering. Because the flaw relies on missing token validation, it can be mitigated by adding CSRF protection or by disabling the endpoint if unnecessary.