CVE-2021-22968

A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you the ability to upload restricted file types and execute them depending on server configuration.To fix this, a check for allowed file extensions was added before downloading files to a tmp directory.Concrete CMS Security Team gave this a CVSS v3.1 score of 5.4 AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:NThis fix is also in Concrete version 9.0.0

• CWE-98
• CWE-330
• CWE-434

• https://documentation.concretecms.org/developers/introduction/version-history/857-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/1350444Exploit, Third Party Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/857-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/1350444Exploit, Third Party Advisory

Published

Nov 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22962An attacker can send a specially crafted request which could…9.1
• CVE-2021-22963A redirect vulnerability in the fastify-static module versio…6.1
• CVE-2021-22964A redirect vulnerability in the `fastify-static` module vers…8.8
• CVE-2021-22965A vulnerability in Pulse Connect Secure before 9.1R12.1 coul…7.5
• CVE-2021-22966Privilege escalation from Editor to Admin using Groups in Co…8.8
• CVE-2021-22967In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allo…7.5
• CVE-2021-22969Concrete CMS (formerly concrete5) versions below 8.5.7 has a…5.3
• CVE-2021-2297Vulnerability in the Oracle VM VirtualBox product of Oracle …5.3
• CVE-2021-22970Concrete CMS (formerly concrete5) versions 8.5.6 and below a…7.5
• CVE-2021-22973On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1…7.5
• CVE-2021-22974On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1…7.5
• CVE-2021-22975On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1…7.5