CVE-2021-40109

A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents of the file from the redirected-to server. Files of disallowed types can be uploaded.

• CWE-918

• https://documentation.concretecms.org/developers/introduction/version-history/856-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/1102105Permissions Required
• https://documentation.concretecms.org/developers/introduction/version-history/856-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/1102105Permissions Required

Published

Sep 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40102An issue was discovered in Concrete CMS through 8.5.5. Arbit…9.1
• CVE-2021-40103An issue was discovered in Concrete CMS through 8.5.5. Path …7.5
• CVE-2021-40104An issue was discovered in Concrete CMS through 8.5.5. There…7.5
• CVE-2021-40105An issue was discovered in Concrete CMS through 8.5.5. There…6.1
• CVE-2021-40106An issue was discovered in Concrete CMS through 8.5.5. There…6.1
• CVE-2021-40108An issue was discovered in Concrete CMS through 8.5.5. The C…8.8
• CVE-2021-4011A flaw was found in xorg-x11-server in versions before 21.1.…7.8
• CVE-2021-40110In Apache James, using Jazzer fuzzer, we identified that an …7.5
• CVE-2021-40111In Apache James, while fuzzing with Jazzer the IMAP parsing …6.5
• CVE-2021-40112Multiple vulnerabilities in the web-based management interfa…7.5
• CVE-2021-40113Multiple vulnerabilities in the web-based management interfa…9.8
• CVE-2021-40114Multiple Cisco products are affected by a vulnerability in t…7.5