Authenticated code execution via staged restricted uploads

Remote file inclusion in Concrete CMS 8.5.6 and earlier allows remote authenticated users to execute code through File Manager. The external URL uploader downloads files with disallowed extensions into a publicly reachable temporary directory whose randomized name can be brute-forced while an upload is stalled. Exploitation requires an administrator who can upload files and a server configuration that executes the staged file type, yielding code execution in the web server context.