Executive brief
Concrete CMS is a popular open-source content management system used to build websites and web applications. A vulnerability in versions 8.3.0 through 9.5.2 allows registered users with calendar event creation permissions to inject malicious scripts into event names. When an administrator reviews pending calendar event approvals in the dashboard, the script executes in their browser, enabling attackers to create unauthorized administrator accounts and take control of the system.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in Concrete CMS's calendar event workflow approval system. Calendar event names are stored without sanitization and rendered without HTML escaping in the "Waiting For Me" dashboard block that shows pending approvals and deletion notifications. An authenticated user with calendar event creation permissions can submit an event with a script payload in the name field. When an administrator reviews the pending request, the malicious script executes in their browser context with administrator privileges, allowing account creation and system compromise. The Concrete CMS team has assigned this a CVSS v4.0 score of 7.3 and confirmed the vulnerability affects versions 8.3.0 through 9.5.2.
Affected products
- Concrete CMS Concrete CMS 8.3.0 to 9.5.2
Timeline
- 2026-09-14: disclosed