CVE-2026-7890CWE-918

Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block

Low · published May 21, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirect-to-internal bypasses.  The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-21T21:43Z
EPSS history
Timeline
  • 21 MAY 21:43Z
    Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block
    cvelistv5