Volerion logoVolerion
Volerion logoVolerion

Concrete CMS RSS Displayer Block Redirect-to-Internal Bypass Vulnerability

Vulnerability

A vulnerability in Concrete CMS versions through 9.5.0 allows the RSS Displayer block to accept feed URLs from any page editor and fetch them server-side without proper validation. This flaw enables redirect-to-internal bypasses.

Impact

Exploitation of this vulnerability could lead to unauthorized access or disclosure of internal resources by bypassing normal redirect mechanisms.

Remediation

Users can upgrade to Concrete CMS version 9.5.1 or later, where this vulnerability has been fixed.

Added: May 21, 2026, 10:39 PM
Updated: May 21, 2026, 10:39 PM

Vulnerability Rating

Custom Algorithm
spread
3.4
impact
0.4
exploitability
4.8
remediation
7.7
relevance
9.0
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.