Executive brief
Concrete CMS, a popular open-source content management system, contains a stored cross-site scripting vulnerability in its page blocks (Feature, Feature Link, Hero Image, and Image blocks). An attacker with page-editing permissions can inject malicious JavaScript through external links that are not properly validated. When any user views or edits the affected page, the injected script executes in their browser, potentially allowing account takeover or full administrative access.
Technical details
This is a stored XSS vulnerability caused by insufficient validation of external link URLs in the link filter combined with missing output escaping when rendering the links. The vulnerable components are the Feature, Feature Link, Hero Image, and Image blocks in Concrete CMS 9 before 9.5.3 and Concrete CMS 8 before 8.5.21. An authenticated user with page-editing permissions (e.g., Add Block and Edit Contents capability on a page) can craft a malicious external link URL that breaks out of link markup and injects arbitrary JavaScript. The script executes in the browser session of any user who subsequently views, previews, or edits the affected page, enabling session hijacking and potential privilege escalation to administrative level. Patches are available in versions 9.5.3 and 8.5.21.
Affected products
- Concrete CMS Concrete CMS 9 before 9.5.3, 8 before 8.5.21
Timeline
- 2026-09-15: disclosed