CVE-2026-68533

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3

Description The conversation attachment uploaded endpoint imports files into the file manager before evaluating the Add Message Attachments permission. Because this permission is only checked after the file has been stored, a user without the required permission or an unauthenticated visitor in a guest-posting configuration can import approved file types into the file manager.

Recommendations Update to version 9.5.3 or later.