CVE-2026-7879
Description
In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading permission-restricted files bypasses the view_file permission check. Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Youssef Eid for reporting
How to fix
- concretecms concrete_cms9.5.1 or later
- concrete5/concrete59.5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| concretecms concrete_cms | v < 9.5.1 | 9.5.1 |
| concrete5/concrete5Packagist | v < 9.5.1 | 9.5.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.