Concrete CMS Cross-Site Request Forgery Vulnerability in File Deletion Controller

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Concrete CMS versions through 9.5.0. The issue arises from an inverted CSRF token validation in the DeleteFile controller, where the system erroneously processes file deletions when the token is invalid or absent. This flaw effectively nullifies CSRF protection for the file deletion endpoint, enabling unauthorized file deletions by exploiting users' permissions to edit conversation messages.

Impact

Exploitation of this vulnerability allows for unauthorized file deletions, potentially disrupting user conversations or workflows that rely on the affected files.

Remediation

Users can upgrade to Concrete CMS version 9.5.1 or later, where this vulnerability has been fixed.