{"cve":"CVE-2023-48648","nvd":{"published":"2023-11-17T04:15:07.093","modified":"2026-06-17T06:34:41.927","status":"Modified","description":"Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-276"],"references":["https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes","https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes","https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release","https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes","https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes"],"products":["concretecms:concrete_cms"],"source":"nvd","synced_at":"2026-10-19T21:42:07.670898610+00:00"},"epss":{"cve":"CVE-2023-48648","score":0.01233,"percentile":0.69018,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}