Executive brief
Concrete CMS, a popular content management system, allows authenticated editors and above to perform searches in file managers and page lists. A vulnerability in these search filters fails to escape SQL wildcard characters, allowing attackers to craft searches that force the database to scan entire tables, consuming excessive CPU and I/O resources and degrading system responsiveness for all other users.
Technical details
The vulnerability is a SQL wildcard injection flaw in the keyword search filters for file manager, file folders, and page list components. The search input is directly inserted into SQL LIKE clauses without escaping wildcard metacharacters (% and _), allowing an authenticated user with editor-level or higher privileges to submit crafted searches containing multiple single-character wildcards. When processed, these searches force full-table database scans instead of indexed lookups. Repeated or wildcard-dense searches can sustain elevated database CPU and I/O load, degrading system performance. The issue requires authentication and elevated privileges but poses a denial-of-service risk on large installations. The vulnerability was patched in version 9.5.3.
Affected products
- Concrete CMS Concrete CMS 9 before 9.5.3
Timeline
- 2026-09-15: disclosed