Executive brief
Concrete CMS, a popular open-source content management system, allows authenticated editors to inject malicious code into page alias names. When administrators or other editors view the Sitemap panel, this code executes automatically in their browser, allowing an attacker to hijack their session and escalate privileges to administrator. This can lead to unauthorized site modifications, data theft, or complete site compromise.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Edit Alias dialog. The application fails to sanitize the customAliasName parameter—it only applies trim() without any input neutralization or output encoding. An authenticated user with canWrite (editor) permission can craft a malicious alias name containing JavaScript code and store it. When administrators or editors open the Sitemap panel, the alias name is rendered unescaped, causing the attacker's JavaScript to execute in their session context. This allows privilege escalation from editor to administrator through session hijacking. The vulnerability requires authentication and user interaction (visiting the Sitemap panel), but affects all administrators and editors who do so.
Affected products
- Concrete CMS Concrete CMS 9.0.0 through 9.5.3
Timeline
- 2026-09-14: disclosed