Executive brief
Concrete CMS, a popular open-source content management system, had a vulnerability where user-submitted data in Express Forms was not properly sanitized before display. An attacker could inject malicious code through a public form, which would then execute in administrators' browsers when they viewed associated entries, or in visitors' browsers viewing pages with Express Entry List blocks, potentially allowing attackers to steal credentials or perform unauthorized actions.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions before 9.5.3. The vulnerability exists in how Express entry labels are rendered when displaying associated entries—the application renders these labels as raw HTML without proper escaping or sanitization. An unauthenticated attacker can submit a payload through a public Express Form. The injected payload persists in the database and executes when an administrator views the associated entry in the dashboard, or when any visitor accesses a page containing an Express Entry List block with association columns displayed. This allows attackers to perform actions with the privileges of the compromised user. The vulnerability has been patched in version 9.5.3.
Affected products
- Concrete CMS Concrete CMS before 9.5.3
Timeline
- 2026-09-15: disclosed