Executive brief
Concrete CMS's Top Navigation Bar block failed to sanitize child page names before displaying them in navigation dropdowns. An attacker with page creation or renaming permissions could inject malicious scripts into page names, which would execute in the browsers of any visitor, editor, or administrator viewing the navigation—potentially allowing account compromise or unauthorized actions on affected sites.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Top Navigation Bar block component. The vulnerability stems from insufficient HTML-escaping of child page names when rendering dropdown navigation elements. An authenticated user with page creation or rename privileges can inject JavaScript payloads into child page names; these scripts are stored and then executed in the browsers of visitors, editors, and administrators when they view the navigation menu and expand the affected dropdown. The attacker gains the privileges of the victim viewing the page. Patches are available in Concrete CMS 9.5.3 and later.
Affected products
- Concrete CMS Concrete CMS 9.0 to 9.5.2
Timeline
- 2026-09-15: disclosed