Executive brief
Concrete CMS versions below 9.5.3 allow editor-level users to inject malicious code into custom style values in the Block Design dialog. This code gets written directly into page CSS without sanitization, enabling attackers with editor privileges to execute scripts in administrators' browser sessions and potentially escalate to full administrative control.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Block Design dialog component. The root cause is insufficient sanitization of custom style values before they are inserted into page CSS via a DOM sink. An authenticated editor-level user can craft malicious style input containing JavaScript that will execute when the CSS is rendered in an administrator's browser. The vulnerability requires editor access and user interaction (an admin must view the affected page), but successful exploitation allows arbitrary script execution in the admin session context, enabling privilege escalation and account takeover. Patches are available in version 9.5.3 and later.
Affected products
- Concrete CMS Concrete CMS below 9.5.3
Timeline
- 2026-09-14: disclosed