Read the docs
TI-2021-05831 Aliases CVE-2021-22970GHSA-gqpw-9q54-9x28

Server-side request forgery in https://github.com/concrete5/concrete5

Priority LOW 36CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on the private LAN servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb. SSRF Mitigation Bypass through DNS RebindingConcrete CMS security team gave this a CVSS score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:NConcrete CMS is maintaining Concrete version 8.5.x until 1 May 2022 for security fixes.This CVE is shared with HackerOne Reports https://hackerone.com/reports/1364797 and https://hackerone.com/reports/1360016Reporters: Adrian Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) and Bipul Jaiswal

Why it matters now

EPSS 0.01485 74th percentileScored 2026-11-07
Fix Fixed concrete5/core (Packagist): 8.5.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/concrete5/concrete5Affected versions Concrete CMS (formerly concrete5) versions below 8.5.6 and 9.0.0. Fixed versions 9.0.1 and 8.5.7—No fix listedCNA
—concrete5/core (Packagist)before 8.5.78.5.7Patch availableGHSA-gqpw-9q54-9x28
  • https://github.com/concrete5/concrete5 Vendor— Affected Affected versions Concrete CMS (formerly concrete5) versions below 8.5.6 and 9.0.0. Fixed versions 9.0.1 and 8.5.7 Fixed in — No fix listed CNA
  • concrete5/core (Packagist) Vendor— Affected before 8.5.7 Fixed in 8.5.7 Patch available GHSA-gqpw-9q54-9x28

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*up to 8.5.6VulnerableConcrete CMS
cpe:2.3:a:concretecms:concrete_cms:9.0:*:*:*:*:*:*:*9.0VulnerableConcrete CMS
  • cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:* Versions up to 8.5.6 Vulnerable ·Concrete CMS
  • cpe:2.3:a:concretecms:concrete_cms:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Concrete CMS

Remediation

  • Fix · GHSA-gqpw-9q54-9x28 concrete5/core (Packagist) Fixed in 8.5.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22970
  2. 2026-10-03 Alias added: GHSA-gqpw-9q54-9x28

References

Advisory 3

Other 1

  • TI-2026-23602 ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager… CVSS 3.1MEDIUM 6.5
  • TI-2023-23992 A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2… CVSS 3.1MEDIUM 5.4
  • TI-2023-26495 Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because… CVSS 3.1CRITICAL 9.8
  • TI-2026-14907 Missing authorization in Concrete CMS CVSS 4.0HIGH 8.7
  • TI-2022-06200 Cleartext transmission of sensitive information in https://github.com/concrete5/concrete5 CVSS 3.1CRITICAL 9.8
  • TI-2021-17294 An issue was discovered in Concrete CMS through 8.5.5. CVSS 3.1CRITICAL 9.8
See all 197 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences