CVE-2023-48648 Concrete CMS allows unauthorized access because directories can be created with insecure permissions

What is CVE-2023-48648?

CVE-2023-48648 is a critical vulnerability in Concretecms Concrete Cms, published on 17 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.

Weakness: CWE-276

Which versions are affected by CVE-2023-48648?

4 open source packages ship an affected version, including concrete5/concrete5. It affects 1 product.

Products include Concretecms Concrete Cms.

How do I fix CVE-2023-48648?

Upgrade concrete5/concrete5 to a fixed version for your release line: 8.5.13 or 9.2.2.

Is CVE-2023-48648 being exploited?

There is no known exploitation of CVE-2023-48648 in the wild and no public exploit code.

Other vulnerabilities in Concretecms Concrete Cms

• CVE-2022-21829 Code injection in concrete CMS Critical 9.8
• CVE-2021-22958 Server-Side Request Forgery vulnerability in concrete5 Critical 9.8
• CVE-2021-40098 Path traversal in n/a Critical 9.8
• CVE-2026-8134 Concrete CMS Vulnerable to Relative Path Traversal Critical 9.4
• CVE-2022-30117 Path traversal in Concrete CMS Critical 9.1

All Concretecms Concrete Cms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m87h-jxr6-f82w.