concrete5/core (packagist) has 9 known vulnerabilities, the worst rated CRITICAL. Upgrade to 9.1.0 or later to clear all of them. No malicious-package signal is recorded.
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File…
CyberXYZ does not call a package safe in absolute terms. It records 9 known vulnerabilities for concrete5/core (packagist), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does concrete5/core have known vulnerabilities?
Yes. CyberXYZ records 9 known vulnerabilities for concrete5/core (packagist), the worst rated CRITICAL. These include GHSA-3jxh-6635-6jwp, GHSA-6xc4-7fmm-65q2, GHSA-g3p2-hfqr-9m25, GHSA-j4mv-2rv7-v2j9, GHSA-m2v2-8227-59f5.
Which version of concrete5/core should I use?
9.1.0 or later clears every advisory recorded for concrete5/core (packagist). Check the release you pick before installing it.
How do I check concrete5/core before installing?
Search concrete5/core in CyberXYZ Check at https://cyberxyz.io/check?q=concrete5%2Fcore. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 12:44 UTC. The most recent advisory here was published 2022-06-25. Updated continuously from NVD, GHSA, OSV and CNA feeds.