Is concrete5/core 9.0 vulnerable?

Composer · 3 releases from 9.0.0 to 9.0.2 · latest concrete5/core is 9.5.7 · checked 2 Nov 2026

Yes: 3 known advisories

Yes. concrete5/core 9.0.2, the last 9.0 release, is affected by 3 known security advisories (1 critical, 1 high, 1 low), including CVE-2022-30117, CVE-2022-21829, CVE-2022-30120. Upgrade to 9.1.0 or later to fix all of them.

Upgrade with:composer require concrete5/core:^9.1.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting concrete5/core 9.0.2

  • CriticalCVE-2022-30117GHSA-3jxh-6635-6jwp25 Jun 2022

    Path traversal in Concrete CMS

    Affected
    >=9.0.0 <9.1.0 · <8.5.8
    Fixed in
    8.5.8, 9.1.0
  • LowCVE-2022-30120GHSA-m2ww-6wv6-vw3c25 Jun 2022

    Cross site scripting in Concrete CMS

    Affected
    >=9.0.0 <9.1.0 · <8.5.8
    Fixed in
    8.5.8, 9.1.0
  • HighCVE-2022-21829GHSA-6xc4-7fmm-65q225 Jun 2022

    Code injection in concrete CMS

    Affected
    >=9.0.0 <9.1.0 · <8.5.8
    Fixed in
    8.5.8, 9.1.0

Which of your client projects are still on concrete5/core 9.0?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact concrete5/core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other concrete5/core versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.