Concrete CMS 9 before 9.5.0 contains a Cross‑Site Request Forgery flaw in the /controllers/backend/file rescanMultiple() endpoint. The flaw arises because the action does not enforce proper CSRF protection, allowing an attacker to force a logged‑in user to trigger a file rescan. Although the vulnerability does not enable arbitrary code execution or data exfiltration, it can still disrupt site administration by unnecessarily scanning files, potentially causing performance degradation in a busy environment.

The affected product is Concrete CMS 9, specifically any installation running a version earlier than 9.5.0. These installations expose the vulnerable rescanMultiple() function in the backend controller, which can be accessed by authenticated users from the administrative interface.

The CVSS v4.0 score is 2.3, indicating low severity, and the system is not listed in CISA KEV. The vector reflects a network attack (AV:N) with a low complexity requirement (AC:L) that needs user interaction (UI:P) and no special privileges (PR:N). Thus, an adversary would need to lure an authenticated administrator to unknowingly activate the rescan. The EPSS score is not available, but the probability of exploitation is low based on the limited impact and absence of public exploit evidence.