CVE-2026-7882— Concrete CMS 跨站请求伪造漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Concrete CMS | Concrete CMS | 5.0≤ 9.5.0 | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-7882の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Concrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controller
ソース: NVD (National Vulnerability Database)
脆弱性説明
Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. The code throws an error when the token IS valid and proceeds with file deletion when the token is invalid or missing. This effectively disables CSRF protection for the file deletion endpoint, allowing cross-site request forgery attacks against users who have permission to edit conversation messages. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
跨站请求伪造(CSRF)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Concrete CMS 跨站请求伪造漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Concrete CMS是Concrete CMS开源的一个面向团队的开源内容管理系统。 Concrete CMS 9.5.0及之前版本存在跨站请求伪造漏洞，该漏洞源于DeleteFile控制器中CSRF令牌检查反转，可能导致跨站请求伪造攻击。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Concrete CMS | Concrete CMS | 5.0 ~ 9.5.0 | - |
II. CVE-2026-7882の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-7882のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-7882 厂商页面 (1)
- 🔗 9.5.1 Release Notes :: Concrete CMSrelease-notes
Same Patch Batch · Concrete CMS · 2026-05-21 · 41 CVEs total
| CVE-2026-8240 | Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure in | |
| CVE-2026-8416 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete | |
| CVE-2026-8412 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete | |
| CVE-2026-8237 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/mess | |
| CVE-2026-8434 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete | |
| CVE-2026-8435 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete | |
| CVE-2026-8414 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete | |
| CVE-2026-8433 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete | |
| CVE-2026-8239 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rat | |
| CVE-2026-8411 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete | |
| CVE-2026-8432 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete | |
| CVE-2026-8236 | Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication | |
| CVE-2026-8413 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete | |
| CVE-2026-8415 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete | |
| CVE-2026-8427 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete | |
| CVE-2026-8238 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message | |
| CVE-2026-8245 | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML | |
| CVE-2026-7890 | Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block | |
| CVE-2026-8139 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName | |
| CVE-2026-8409 | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete |
Showing 20 of 41 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Concrete CMS
- CVE-2026-10721
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injecti - CVE-2026-7888
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injecti - CVE-2026-8353
Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XS - CVE-2026-8347
Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-a - CVE-2026-8340
Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backe
同じベンダー: Concrete CMS
- CVE-2026-10721
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injecti - CVE-2026-7888
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injecti - CVE-2026-8353
Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XS - CVE-2026-8347
Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-a - CVE-2026-8340
Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backe
同じ弱点: CWE-352
- CVE-2026-49396
Nezha Monitoring: Cross-site GET request can trigger stored - CVE-2026-54359
MISP automation endpoints may be exposed to CSRF when Sec-Fe - CVE-2026-48612
OAuth状态验证不当致账号接管 - CVE-2022-47150
WordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - - CVE-2022-44630
WordPress YITH WooCommerce Product Slider Carousel plugin <=
V. CVE-2026-7882へのコメント
まだコメントはありません